Tamper-respondent assemblies with bond protection

ABSTRACT

Methods of fabricating tamper-respondent assemblies with bond protection are provided which include at least one tamper-respondent sensor having unexposed circuit lines forming, at least in part, one or more tamper-detect network(s), and the tamper-respondent sensor having at least one external bond region. The tamper-respondent assembly further includes at least one conductive trace and an adhesive. The conductive trace(s) forms, at least in part, the one or more tamper-detect network(s), and is exposed, at least in part, on the tamper-respondent sensor(s) within the external bond region(s). The adhesive contacts the conductive trace(s) within the external bond region(s) of the tamper-respondent sensor(s), and the adhesive, in part, facilitates securing the at least one tamper-respondent sensor within the tamper-respondent assembly. In enhanced embodiments, the conductive trace(s) is a chemically compromisable conductor susceptible to damage during a chemical attack on the adhesive within the external bond region(s).

BACKGROUND

Many activities require secure electronic communications. To facilitatesecure electronic communications, an encryption/decryption system may beimplemented on an electronic assembly or printed circuit board assemblythat is included in equipment connected to a communications network.Such an electronic assembly is an enticing target for malefactors sinceit may contain codes or keys to decrypt intercepted messages, or toencode fraudulent messages. To prevent this, an electronic assembly maybe mounted in an enclosure, which is then wrapped in a security sensorand encapsulated with polyurethane resin. A security sensor may be, inone or more embodiments, a web or sheet of insulating material withcircuit elements, such as closely-spaced, conductive lines fabricated onit. The circuit elements are disrupted if the sensor is torn, and thetear can be sensed in order to generate an alarm signal. The alarmsignal may be conveyed to a monitor circuit in order to reveal an attackon the integrity of the assembly. The alarm signal may also trigger anerasure of encryption/decryption keys stored within the electronicassembly.

BRIEF SUMMARY

In one or more aspects, is a method of fabricating a tamper-respondentassembly is provided, which includes: providing at least onetamper-respondent sensor, the at least one tamper-respondent sensorcomprising one or more tamper-detect networks, and the at least onetamper-respondent sensor having at least one external bond region;providing at least one conductive trace forming, at least in part, atleast one tamper-detect network of the one or more tamper-detectnetworks, the at least one conductive trace being exposed, at least inpart, on the at least one tamper-respondent sensor within the at leastone bond region; and providing an adhesive contacting the at least oneconductive trace within the at least one bond region of the at least onetamper-respondent sensor, the adhesive facilitating securing the atleast one tamper-respondent sensor within he tamper-respondent assembly.

Additional features and advantages are realized through the techniquesof the present invention. Other embodiments and aspects of the inventionare described in detail herein and are considered a part of the claimedinvention.

BRIEF DESCRIPTION OF THE DRAWINGS

One or more aspects of the present invention are particularly pointedout and distinctly claimed as examples in the claims at the conclusionof the specification. The foregoing and other objects, features, andadvantages of the invention are apparent from the following detaileddescription taken in conjunction with the accompanying drawings inwhich:

FIG. 1 is a partial cut-away of one embodiment of a tamper-proofelectronic package which may incorporate a tamper-respondent electroniccircuit structure, in accordance with one or more aspects of the presentinvention;

FIG. 2 is a cross-sectional elevational view of one embodiment of aprior art, tamper-proof electronic package comprising an electroniccircuit;

FIG. 3A depicts one embodiment of a tamper-respondent sensor comprisingone or more flexible layers and circuit lines forming at least onetamper-detect network, in accordance with one or more aspects of thepresent invention;

FIG. 3B is a cross-sectional elevational view of another embodiment of atamper-respondent sensor, in accordance with one or more aspects of thepresent invention;

FIG. 3C is a cross-sectional elevational view of another embodiment of atamper-respondent sensor, in accordance with one or more aspects of thepresent invention;

FIG. 3D is a cross-sectional elevational view of a further embodiment ofa tamper-respondent sensor, in accordance with one or more aspects ofthe present invention;

FIG. 3E depicts a cross-sectional elevational view of another embodimentof a tamper-respondent sensor, in accordance with one or more aspects ofthe present invention;

FIG. 4A is a partial depiction of one embodiment of a tamper-respondentsensor comprising a corrugated layer of flexible dielectric with circuitlines, in accordance with one or more aspects of the present invention;

FIG. 4B depicts an alternate embodiment of a tamper-respondent sensorcomprising multiple corrugated layers of flexible dielectric withcircuit lines, in accordance with one or more aspects of the presentinvention;

FIG. 5A depicts one embodiment of a tamper-respondent sensor comprisinga flattened, folded layer with circuit lines, in accordance with one ormore aspects of the present invention;

FIG. 5B is a partial plan view of the flattened, folded layer withcircuit lines of FIG. 5A, in accordance with one or more aspects of thepresent invention;

FIG. 5C is a partial cross-sectional elevational view of atamper-respondent sensor comprising a flattened, folded layer withcircuit lines, and at least one other layer overlying one or both sidesof the flattened, folded layer, in accordance with one or more aspectsof the present invention;

FIG. 5D depicts another embodiment of the tamper-respondent sensor ofFIG. 5C, further comprising a breakable layer for enhancedtamper-detection capabilities, in accordance with one or more aspects ofthe present invention;

FIG. 5E is a partial cross-sectional elevational view of atamper-respondent sensor comprising a flattened, folded layer withcircuit lines, and at least one other layer overlying the lower surfaceof the flattened, folded layer, in accordance with one or more aspectsof the present invention;

FIG. 5F is a partial cross-sectional elevational view of a furtherembodiment of a tamper-respondent sensor comprising a flattened, foldedlayer with circuit lines sandwiched between two other layers overlyingopposite sides of the flattened, folded layer, in accordance with one ormore aspects of the present invention;

FIG. 5G depicts a partial cross-sectional elevational view of anotherembodiment of a tamper-respondent sensor which comprises multipleflattened, folded layers with circuit lines separated by at least oneother layer in a stack of layers, in accordance with one or more aspectsof the present invention;

FIG. 5H depicts a partial cross-sectional elevational view of a furtherembodiment of a tamper-respondent sensor comprising a stack of layerswith multiple flattened, folded layers with circuit lines, and multipleother layers, for instance, multiple other flexible layers, disposedabove and/or below the flattened, folded layers with circuit lines, inaccordance with one or more aspects of the present invention;

FIG. 6A is a cross-sectional elevational view of a tamper-respondentassembly comprising an electronic enclosure and a tamper-respondentelectronic circuit structure comprising a tamper-respondent sensor,where the tamper-respondent sensor comprises a flattened, folded layerwith circuit lines that wraps around the electronic enclosure, inaccordance with one or more aspects of the present invention;

FIG. 6B is a cross-sectional elevational view of a tamper-respondentassembly comprising an electronic enclosure and a tamper-respondentelectronic circuit structure comprising multiple tamper-respondentsensors, where the tamper-respondent sensors comprise multiple discreteflattened, folded layers with circuit lines, wherein one flattened,folded layer along the edge or side of the enclosure wraps around anddoubles over the flattened, folded layers with circuit lines locatedabove and below the enclosure, in accordance with one or more aspects ofthe present invention;

FIG. 6C is an upper (or lower) plan view of one embodiment of thetamper-respondent assembly of FIG. 6B, in accordance with one or moreaspects of the present invention;

FIG. 6D is a cross-sectional elevational view of a further embodiment ofa tamper-respondent assembly comprising an electronic enclosure and atamper-respondent electronic circuit structure comprising multipletamper-respondent sensors, where the tamper-respondent sensors comprisemultiple flattened, folded layers with circuit lines, and one flattened,folded layer wraps around the edge of the electronic enclosure, and theother flattened, folded layers located above and below the electronicenclosure wrap over the flattened, folded layer positioned around theedge of the electronic enclosure, in accordance with one or more aspectsof the present invention;

FIG. 6E is a plan view of one embodiment of an upper (or lower)tamper-respondent sensor for use in a tamper-respondent assembly such asdepicted in FIG. 6D, wherein the upper (or lower) tamper-respondentsensor is depicted by way of example only as a flattened, folded layer,in accordance with one or more aspects of the present invention;

FIG. 6F is a plan view of a further embodiment of an upper (or lower)tamper-respondent sensor for a tamper-respondent assembly such asdepicted in FIG. 6D, wherein the upper (or lower) tamper-respondentsensor is depicted by way of example only as a flattened, folded layer,in accordance with one or more aspects of the present invention;

FIG. 6G is a cross-sectional elevational view of a further embodiment ofa tamper-respondent assembly comprising an electronic enclosure and atamper-respondent electronic circuit structure comprising multipletamper-respondent sensors, where the tamper-respondent sensors comprisetwo flattened, folded layers with circuit lines surrounding theelectronic enclosure and overlapping along the edge or side thereof, inaccordance with one or more aspects of the present invention;

FIG. 7A is a plan view of one embodiment of a first tamper-respondentsensor to be interweaved with a similarly constructed, secondtamper-respondent sensor, in accordance with one or more aspects of thepresent invention;

FIG. 7B is a plan view of one embodiment of a tamper-respondentelectronic circuit structure comprising two discrete tamper-respondentsensors, such as depicted in FIG. 7A, interweaved in a multi-sensorinterweaved layer, in accordance with one or more aspects of the presentinvention;

FIG. 7C depicts, by way of further example, a stack of multi-sensorinterweaved layers which may be employed, for instance, in associationwith an electronic enclosure within a tamper-respondent assembly todefine a secure volume, in accordance with one or more aspects of thepresent invention;

FIG. 8A is a cross-sectional elevational view of one embodiment of atamper-respondent assembly, or tamper-proof electronic package, whichincludes (in part) a tamper-respondent sensor embedded within amultilayer circuit board, in accordance with one or more aspects of thepresent invention;

FIG. 8B is a top plan view of the multilayer circuit board of FIG. 8A,depicting one embodiment of the secure volume where defined, in part,within the multilayer circuit board, in accordance with one or moreaspects of the present invention;

FIG. 9 is a partial cross-sectional elevational view of atamper-respondent assembly comprising (in part) a multilayer circuitboard and embedded tamper-respondent sensor, in accordance with one ormore aspects of the present invention;

FIG. 10 depicts one embodiment of a process of fabricating a multilayercircuit board with an embedded tamper-respondent sensor, in accordancewith one or more aspects of the present invention;

FIG. 11 is a partial cross-sectional elevational view of atamper-respondent assembly comprising an electronic enclosure andassociated tamper-respondent sensor, and a multilayer circuit board withan embedded tamper-respondent sensor therein, in accordance with one ormore aspects of the present invention;

FIG. 12 depicts one embodiment of a process for affixing atamper-respondent sensor to an inside surface of an electronicenclosure, such as for use with a tamper-respondent assembly describedherein with reference to FIGS. 8A-11, in accordance with one or moreaspects of the present invention;

FIG. 13A depicts an underside, isometric view of one embodiment of anelectronic enclosure such as depicted in FIGS. 8A, 11 & 12, andillustrating placement of an inner-sidewall tamper-respondent sensorover an inner sidewall surface of the electronic enclosure, inaccordance with one or more aspects of the present invention;

FIG. 13B depicts the structure of FIG. 13A, with an inner main surfacetamper-respondent sensor provided over an inner main surface of theelectronic enclosure, and with the inner main surface tamper-respondentsensor shown overlapping, at least in part, the inner-sidewalltamper-respondent sensor, in accordance with one or more aspects of thepresent invention;

FIG. 13C is an enlarged, corner depiction of the electronic enclosureand tamper-respondent sensors of FIG. 13B, illustrating the inner mainsurface tamper-respondent sensor overlying the inner-sidewalltamper-respondent sensor at an inner corner of the electronic enclosure,in accordance with one or more aspects of the present invention;

FIG. 14A depicts an underside, isometric view of one embodiment of anelectronic enclosure, or electronic assembly enclosure, such as depictedin FIGS. 13A-13C, in accordance with one or more aspects of the presentinvention;

FIG. 14B is an enlarged view of the inner-sidewall corner of FIG. 14A,illustrating region 14B thereof, in accordance with one or more aspectsof the present invention;

FIG. 15A depicts an underside, perspective view of one embodiment of atamper-respondent assembly comprising an electronic enclosure such asdepicted in FIGS. 14A-14B, in accordance with one or more aspects of thepresent invention;

FIG. 15B depicts an exploded view of the tamper-respondent assembly ofFIG. 15A, in accordance with one or more aspects of the presentinvention;

FIG. 16A is an isometric view of one embodiment of an inner-sidewalltamper-respondent sensor for covering an inner sidewall surface ofelectronic enclosure such as depicted in FIG. 14A, in accordance withone or more aspects of the present invention;

FIG. 16B depicts an underside, isometric view of the electronicenclosure and inner-sidewall tamper-respondent sensor of FIGS. 15A &15B, with the inner-sidewall tamper-respondent sensor shown positionedover the inner sidewall surface of the electronic enclosure, inaccordance with one or more aspects of the present invention;

FIG. 16C is an enlarged depiction of the tamper-respondent assembly ofFIG. 16B, illustrating region 16C thereof, in accordance with one ormore aspects of the present invention;

FIG. 17A is an enlarged depiction of the inner main surfacetamper-respondent sensor embodiment illustrated in FIGS. 15A & 15B, inaccordance with one or more aspects of the present invention;

FIG. 17B depicts the inner main surface tamper-respondent sensor of FIG.17A, with the corner tabs shown raised for positioning, as illustratedin FIGS. 15A & 15B, in accordance with one or more aspects of thepresent invention;

FIG. 17C depicts the tamper-respondent assembly of FIGS. 15A & 15B, withthe inner main surface tamper-respondent sensor positioned therein, andwith the security elements(s) removed, in accordance with one or moreaspects of the present invention;

FIG. 18 is a perspective view of the security elements(s) illustrated inFIGS. 15A & 15B for the tamper-respondent assembly depicted, inaccordance with one or more aspects of the present invention; and

FIG. 19A is a partial cross-sectional elevational view of anotherembodiment of a tamper-respondent assembly comprising a structure with arigid surface and a tamper-respondent sensor secured to the rigidsurface of the structure, in accordance with one or more aspects of thepresent invention;

FIG. 19B is a cross-sectional elevational view of another embodiment ofa tamper-respondent assembly comprising a tamper-respondent sensorsecured to an electronic enclosure, and to a rigid surface of anotherstructure, such as a thermal spreader, in accordance with one or moreaspects of the present invention;

FIG. 20A is a partial isometric view of a further embodiment of atamper-respondent sensor for a tamper-respondent assembly, in accordancewith one or more aspects of the present invention;

FIG. 20B is a partial isometric view of another embodiment of atamper-respondent sensor for a tamper-respondent assembly, in accordancewith one or more aspects of the present invention;

FIG. 21A is a cross-sectional elevational view of another embodiment ofa tamper-respondent assembly comprising first and secondtamper-respondent sensors secured to an electronic enclosure, inaccordance with one or more aspects of the present invention;

FIG. 21B is an isometric view of one embodiment of an inner main surfacetamper-respondent sensor with one or more conductive traces in one ormore bond regions thereof, in accordance with one or more aspects of thepresent invention; and

FIG. 21C is a cross-sectional elevational view of the tamper-respondentassembly of FIG. 21A, illustrating an attempted line of attack throughthe electronic enclosure and adhesive encountering the one or moreconductive traces, in accordance with one or more aspects of the presentinvention.

DETAILED DESCRIPTION

Aspects of the present invention and certain features, advantages, anddetails thereof, are explained more fully below with reference to thenon-limiting example(s) illustrated in the accompanying drawings.Descriptions of well-known materials, fabrication tools, processingtechniques, etc., are omitted so as not to unnecessarily obscure theinvention in detail. It should be understood, however, that the detaileddescription and the specific example(s), while indicating aspects of theinvention, are given by way of illustration only, and are not by way oflimitation. Various substitutions, modifications, additions, and/orarrangements, within the spirit and/or scope of the underlying inventiveconcepts will be apparent to those skilled in the art for thisdisclosure. Note further that reference is made below to the drawings,which are not drawn to scale for ease of understanding, wherein the samereference numbers used throughout different figures designate the sameor similar components. Also, note that numerous inventive aspects andfeatures are disclosed herein, and unless otherwise inconsistent, eachdisclosed aspect or feature is combinable with any other disclosedaspect or feature as desired for a particular application, forestablishing a secure volume about an electronic component or electronicassembly to be protected.

Reference is first made to FIG. 1 of the drawings, which illustrates oneembodiment of an electronic assembly package 100 configured as atamper-proof electronic assembly package for purposes of discussion. Inthe depicted embodiment, an electronic assembly enclosure 110 isprovided containing, for instance, an electronic assembly, which in oneembodiment may include a plurality of electronic components, such as anencryption and/or decryption module and associated memory. Theencryption and/or decryption module may comprise security-sensitiveinformation with, for instance, access to the information stored in themodule requiring use of a variable key, and with the nature of the keybeing stored in the associated memory within the enclosure.

In one or more implementations, a tamper-proof electronic package suchas depicted is configured or arranged to detect attempts to tamper-withor penetrate into electronic assembly enclosure 110. Accordingly,electronic assembly enclosure 110 also includes, for instance, a monitorcircuit which, if tampering is detected, activates an erase circuit toerase information stored within the associated memory, as well as theencryption and/or decryption module within the communications card.These components may be mounted on, and interconnected by, a multi-layercircuit board, such as a printed circuit board or other multi-layersubstrate, and be internally or externally powered via a power supplyprovided within the electronic assembly enclosure.

In the embodiment illustrated, and as one example only, electronicassembly enclosure 110 may be surrounded by a tamper-respondent sensor120, an encapsulant 130, and an outer, thermally conductive enclosure140. In one or more implementations, tamper-respondent sensor 120 mayinclude a tamper-respondent laminate that is folded around electronicassembly enclosure 110, and encapsulant 130 may be provided in the formof a molding. Tamper-respondent sensor 120 may include various detectionlayers, which are monitored through, for instance, a ribbon cable by theenclosure monitor, against sudden violent attempts to penetrateenclosure 110 and damage the enclosure monitor or erase circuit, beforeinformation can be erased from the encryption module. Thetamper-respondent sensor may be, for example, any such articlecommercially available or described in various publications and issuedpatents, or any enhanced article such as disclosed herein.

By way of example, tamper-respondent sensor 120 may be formed as atamper-respondent laminate comprising a number of separate layers with,for instance, an outermost lamination-respondent layer including amatrix of, for example, diagonally-extending or sinusoidally-extending,conductive or semi-conductive lines printed onto a regular, thininsulating film. The matrix of lines forms a number of continuousconductors which would be broken if attempts are made to penetrate thefilm. The lines may be formed, for instance, by printing carbon-loadedPolymer Thick Film (PTF) ink onto the film and selectively connectingthe lines on each side, by conductive vias, near the edges of the film.Connections between the lines and an enclosure monitor of thecommunications card may be provided via, for instance, one or moreribbon cables. The ribbon cable itself may be formed of lines ofconductive ink printed onto an extension of the film, if desired.Connections between the matrix and the ribbon cable may be made viaconnectors formed on one edge of the film. As noted, the laminate may bewrapped around the electronic assembly enclosure to define thetamper-respondent sensor 120 surrounding enclosure 110.

In one or more implementations, the various elements of the laminate maybe adhered together and wrapped around enclosure 110, in a similarmanner to gift-wrapping a parcel, to define the tamper-respondent sensorshape 120. The assembly may be placed in a mold which is then filledwith, for instance, cold-pour polyurethane, and the polyurethane may becured and hardened to form an encapsulant 130. The encapsulant may, inone or more embodiments, completely surround the tamper-respondentsensor 120 and enclosure 110, and thus form a complete environmentalseal, protecting the interior of the enclosure. The hardenedpolyurethane is resilient and increases robustness of the electronicpackage in normal use. Outer, thermally conductive enclosure 140 mayoptionally be provided over encapsulant 130 to, for instance, providefurther structural rigidity to the electronic package.

Note that, as an enhancement, within a sealed electronic package, suchas the tamper-proof electronic package depicted in FIG. 1 and describedabove, structures and methods for facilitating heat transfer from one ormore electronic components disposed therein outwards through theenclosure and any other layers of the electronic package may beprovided.

FIG. 2 depicts in detail one embodiment of a typical tamper-proofelectronic package 200. Electronic package 200 is defined by, forinstance, a base metal shell 202 and a top metal shell 204. Outersurfaces of base metal shell 202 and top metal shell 204 may be providedwith standoffs 206, with an electronic assembly 208 resting on standoffs206 defined in base metal shell 202. Electronic assembly 208 mayinclude, for instance, a printed circuit board 210 with electroniccomponents 212 that are electrically connected via conductors (notshown) defined within or on printed circuit board 210.

Hollow spacers 213 may be placed below dimples 206 in top metal shell204, and rivets 214 provided, extending through openings in dimples 206,through hollow spacers 213 and through openings in printed circuit board210 to base metal shell 202 in order to fixedly secure electronicassembly 208 within the enclosure formed by base and top metal shells202, 204. A security mesh or tamper-respondent sensor 216 is wrappedaround the top, base, and four sides of the enclosure formed by base andtop metal shells 202, 204. As illustrated, in one or more embodiments,top metal shell 204 may have an opening through which a bus 220 extends.One end of bus 220 may be connected to conductors (not shown) on printedcircuit board 210, and the other end may be connected to conductors (notshown) on a printed circuit board 222. As bus 220 passes through theopening, the bus extends between an inner edge region 223 of thesecurity mesh 216 and an overlapping, outer edge region 224 of thesecurity mesh 216. A group of wires 226 connect, in one embodiment,security mesh 216 to conductors on printed circuit board 210. Circuitryon printed circuit board 210 is responsive to a break or discontinuityin security sensor array 216, in which case, an alarm signal may beemitted on bus 220, and also encryption/decryption keys stored withinelectronic assembly 208 may be erased.

In one or more implementations, liquid polyurethane resin may be appliedto security mesh 216 and cured. An outer, thermally conductive enclosure228, such as a copper enclosure, may be filled with liquid polyurethaneresin with the electronic assembly and inner enclosure and security meshsuspended within it. Upon curing the resin, the electronic assembly andinner enclosure and security mesh become embedded in a polyurethaneblock or encapsulant 230, as shown. The enclosure 228 is mounted on theprinted circuit board 222, which can be accomplished using, forinstance, legs 240 which extend through slots in printed circuit board222 and terminate in flanges 242, which are then bent out of alignmentwith the slots. Bus 220 may be connected, by way of printed circuitboard 222 to connectors 244 located along, for instance, one edge ofprinted circuit board 222.

When considering tamper-proof packaging, the electronic package needs tomaintain defined tamper-proof requirements, such as those set forth inthe National Institutes of Standards and Technology (NIST) PublicationFIPS 140-2, which is a U.S. Government Computer Security Standard, usedto accredit cryptographic modules. The NIST FIPS 140-2 defines fourlevels of security, named Level 1 to Level 4, with Security Level 1providing the lowest level of security, and Security Level 4 providingthe highest level of security. At Security Level 4, physical securitymechanisms are provided to establish a complete envelope of protectionaround the cryptographic module, with the intent of detecting andresponding to any unauthorized attempt at physical access. Penetrationof the cryptographic module enclosure from any direction has a very highprobability of being detected, resulting in the immediate zeroization ofall plain text critical security parameters (CSPs). Security Level 4cryptographic modules are useful for operation in physically unprotectedenvironments. Security Level 4 also protects a cryptographic moduleagainst a security compromise due to environmental conditions orfluctuations outside of the module's normal operating ranges forvoltages and temperature. Intentional excursions beyond the normaloperating ranges may be used by an attacker to thwart the cryptographicmodule's defenses. The cryptographic module is required to eitherinclude specialized environmental protection features designed to detectfluctuations and zeroize critical security parameters, or to undergorigorous environmental failure testing to provide reasonable assurancethat the module will not be affected by fluctuations outside of thenormal operating range in a manner that can compromise the security ofthe module.

To address the demands of ever-improving anti-intrusion technology, andthe higher-performance encryption/decryption functions being provided,enhancements to the tamper-proof, tamper-evident packaging for theelectronic assembly at issue are desired. Numerous enhancements aredescribed hereinbelow to, for instance, tamper-respondent assemblies andtamper-respondent sensors. Note that the numerous inventive aspectsdescribed herein may be used singly, or in any desired combination.Additionally, in one or more implementations, the enhancements totamper-proof electronic packaging described herein may be provided towork within defined space limitations for existing packages. Forinstance, one or more of the concepts described may be configured towork with peripheral component interconnect express (PCIe) size limits,and the limitations resulting from being capsulated in, for instance, aninsulating encapsulant.

Thus, disclosed hereinbelow with reference to FIGS. 3A-21C are variousapproaches and/or enhancements to creating a secure volume foraccommodating one or more electronic components, such as one or moreencryption and/or decryption modules and associated components of acommunications card or other electronic assembly.

FIG. 3A depicts a portion of one embodiment of a tamper-respondent layer305 (or laser and pierce-respondent layer) of a tamper-respondent sensor300 or security sensor, such as discussed herein. In FIG. 3A, thetamper-respondent layer 305 includes circuit lines or traces 301provided on one or both opposite sides of a flexible layer 302, which inone or more embodiments, may be a flexible insulating layer or film.FIG. 3A illustrates circuit lines 301 on, for instance, one side offlexible layer 302, with the traces on the opposite side of the filmbeing, for instance, the same pattern, but (in one or more embodiments)offset to lie directly below spaces 303, between circuit lines 301. Asdescribed below, the circuit lines on one side of the flexible layer maybe of a line width W_(l) and have a pitch or line-to-line spacing W_(s)such that piercing of the layer 305 at any point results in damage to atleast one of the circuit lines traces 301. In one or moreimplementations, the circuit lines may be electrically connectedin-series or parallel to define one or more conductors which may beelectrically connected in a network to an enclosure monitor, whichmonitors the resistance of the lines, as described herein. Detection ofan increase, or other change, in resistance, caused by cutting ordamaging one of the traces, will cause information within the encryptionand/or decryption module to be erased. Providing conductive lines 301 ina pattern, such as a sinusoidal pattern, may advantageously make it moredifficult to breach tamper-respondent layer 305 without detection. Note,in this regard, that conductive lines 301 could be provided in anydesired pattern. For instance, in an alternate implementation,conductive lines 301 could be provided as parallel, straight conductivelines, if desired, and the pattern or orientation of the pattern mayvary between sides of a layer, and/or between layers.

As noted, as intrusion technology continues to evolve, anti-intrusiontechnology needs to continue to improve to stay ahead. In one or moreimplementations, the above-summarized tamper-respondent sensor 300 ofFIG. 3A may be disposed over an outer surface of an electronicenclosure, such as an electronic enclosure described above in connectionwith FIGS. 1 & 2. Alternatively, as described further herein, thetamper-respondent sensor may cover or line an inner surface of anelectronic enclosure to provide a secure volume about at least oneelectronic component to be protected. Numerous enhancements to thetamper-respondent sensor itself are described below.

In one or more aspects, disclosed herein is a tamper-respondent sensor300 with circuit lines 301 having reduced line widths W_(l) of, forinstance, 200 μm, or less, such as less than or equal to 100 μm, or evenmore particularly, in the range of 30-70 μm. This is contrasted withconventional trace widths, which are typically on the order of 350 μm orlarger. Commensurate with reducing the circuit line width W_(l),line-to-line spacing width W_(s) 303 is also reduced to less than orequal to 200 μm, such as less than or equal to 100 μm, or for instance,in a range of 30-70 μm. Advantageously, by reducing the line width W_(l)and line-to-line spacing W_(s) of circuit lines 301 withintamper-respondent sensor 300, the circuit line width and pitch is on thesame order of magnitude as the smallest intrusion instruments currentlyavailable, and therefore, any intrusion attempt will necessarily removea sufficient amount of a circuit line(s) to cause resistance to change,and thereby the tamper intrusion to be detected. Note that, by makingthe circuit line width of the smaller dimensions disclosed herein, anycutting or damage to the smaller-dimensioned circuit line will also bemore likely to be detected, that is, due to a greater change inresistance. For instance, if an intrusion attempt cuts a 100 μm widthline by 50%, it reduces the remaining available line width forconducting current to 50 μm. This change is more likely to result in adetectable change in resistance, compared with, for instance, a 50%reduction in a more conventional line width of 350 μm to, for instance,175 μm. The smaller the conductive circuit line width becomes, the morelikely that a tampering of that line will be detected.

Note also that a variety of materials may advantageously be employed toform the circuit lines. For instance, the circuit lines may be formed ofa conductive ink (such as a carbon-loaded conductive ink) printed ontoone or both opposite sides of one or more of the flexible layers 302 ina stack of such layers. Alternatively, a metal or metal alloy could beused to form the circuit lines, such as copper, silver, silver carbon,or nickel-phosphorus (NiP), or Omega-Ply®, offered by OmegaTechnologies, Inc. of Culver City, Calif. (USA), or Ticer™ offered byTicer Technologies, Chandler, Ariz. (USA). Note that the processemployed to form the fine circuit lines or traces on the order describedherein is dependent, in part, on the choice of material used for thecircuit lines. For instance, if copper circuit lines are beingfabricated, then additive processing, such as plating up copper traces,or subtractive processing, such as etching away unwanted copper betweentrace lines, may be employed. By way of further example, if conductiveink is employed as the circuit line material, fine circuit lines on theorder disclosed herein can be achieved by focusing on the rheologicalproperties of the conductive ink formulation. Further, rather thansimple pneumatics of pushing conductive ink through an aperture in astencil with a squeegee, the screen emulsion may be characterized asvery thin (for instance, 150 to 200 μm), and a squeegee angle may beused such that the ink is sheared to achieve conductive ink breakawayrather than pumping the conductive ink through the screen apertures.Note that the screen for fine line width printing such as describedherein may have the following characteristics in one specificembodiment: a fine polyester thread for both warp and weave on the orderof 75 micrometers; a thread count between 250-320 threads per inch; amesh thickness of, for instance, 150 micrometers; an open area betweenthreads that is at least 1.5× to 2.0× the conductive ink particle size;and to maintain dimensional stability of the print, the screen snap-offis kept to a minimum due the screen strain during squeegee passage.

In one or more implementations, circuit lines 301 of tamper-respondentsensor 300 are electrically connected to define one or more resistivenetworks. Further, the circuit lines may include one or more resistivecircuit lines by selecting the line material, line width W_(l) and linelength L₁, to provide a desired resistance per line. As one example, a“resistive circuit line” as used herein may comprise a line with 1000ohms resistance or greater, end-to-end. In one specific example, acircuit line width of 50 μm, with a circuit line thickness of 10 μm maybe used, with the line length L₁ and material selected to achieve thedesired resistance. At the dimensions described, good electricalconductors such as copper or silver may also be employed and still forma resistive network due to the fine dimensions noted. Alternatively,materials such as conductive ink or the above-noted Omega-Ply® or Ticer™may be used to define resistive circuit lines.

In a further aspect, the flexible layer 302 itself may be furtherreduced in thickness from a typical polyester layer by selecting acrystalline polymer to form the flexible layer or substrate. By way ofexample, the crystalline polymer could comprise polyvinylidenedifluoride (PVDF), or Kapton, or other crystalline polymer material.Advantageously, use of a crystalline polymer as the substrate film mayreduce thickness of the flexible layer 302 to, for instance, 2 milsthick from a more conventional amorphous polyester layer of, forinstance, 8 mils. A crystalline polymer can be made much thinner, whilestill maintaining structural integrity of the flexible substrate, whichadvantageously allows for far more folding, and greater reliability ofthe sensor after folding. Note that the radius of any fold or curvatureof the sensor is necessarily constrained by the thickness of the layerscomprising the sensor. Thus, by reducing the flexible layer thicknessto, for instance, 2 mils, then in a four tamper-respondent layer stack,the stack thickness can be reduced from, for instance, 30 mils in thecase of a typical polyester film, to 10 mils or less with the use ofcrystalline polymer films.

As noted, the circuit lines 301 forming the at least one resistivenetwork may be disposed on either the first side or the second side ofthe opposite sides of the flexible layer(s) 302 within thetamper-respondent sensor 300, or on both the first and second sides. Oneembodiment of this depicted in FIG. 3B, wherein circuit lines 301 areillustrated on both opposite sides of flexible layer 302. In thisexample, circuit lines 301 on the opposite sides of thetamper-respondent sensor 302 may each have line widths W_(l) less thanor equal to 200 μm, and those lines widths may be the same or different.Further, the line-to-line spacing width W_(s) between adjacent lines ofthe circuit lines 301 may also be less than or equal to 200 μm, and mayalso be the same or different. In particular, the circuit lines may bedifferent line widths on the two different sides of thetamper-respondent layer, and the line-to-line spacing widths may also bedifferent. For instance, a first side of the tamper-respondent layer mayhave circuit line widths and line-to-line spacings of approximately 50microns, while the second side of the tamper-respondent layer may havecircuit lines and line-to-line spacing of 70 microns. Intrusion throughthe sensor is potentially made more difficult by providing suchdifferent widths. Circuit lines 301 on the opposite sides of theflexible layer 302 may also be in the same or different patterns, and inthe same or different orientations. If in the same pattern, the circuitlines may be offset, as noted above, such that the circuit lines of oneside align to spaces between circuit lines on the other side.

As illustrated in FIG. 3C, the tamper-respondent sensor 300 may comprisea stack of tamper-respondent layers 305 secured together via an adhesive311, such as a double-sided adhesive film. The process may be repeatedto achieve any desired number of tamper-respondent layers, or moreparticularly, any desired number of layers of circuit lines 301 withinthe tamper-respondent sensor to achieve a desired anti-intrusion sensor.

An alternate tamper-respondent sensor 300′ is depicted in FIG. 3D, wheremultiple flexible layers 302 with circuit lines are secured together viaan adhesive 311, and by way of example, circuit lines are provided onone or both sides of each flexible layer. In this example, a firstflexible layer 302 has first circuit lines 301 and a second flexiblelayer 302 has second circuit lines 301′. In one or more implementationsthe first circuit lines may have a first line width W_(l) and the secondcircuit lines may have a second line width W_(l), where the first linewidth of the first circuit lines 301 is different from the second linewith the second circuit lines 301′. For instance, the first circuit linewidth may be 50 μm, and the second circuit line width may be 45 μm. Notethat any desired combination of circuit line widths may be employed inthis example, which assumes that the circuit line widths may bedifferent between at least two of the layers. Additionally, the firstcircuit lines 301 of the first flexible layer may have firstline-to-line spacing width W_(s) and the second circuit lines 301′ ofsecond flexible layer may have a second line-to-line spacing widthW_(s), where the first line-to-line spacing width of the first circuitlines may be different from the second line-to-line spacing width of thesecond circuit lines. Note that this concept applies as well to circuitlines on only one side of flexible layer 302, where two or more of theflexible layers in the stack defining the tamper-respondent sensor mayhave different circuit line widths and/or different line-to-line spacingwidths. This concept may be extended to any number of tamper-respondentlayers within the tamper-respondent sensor to provide a desired degreeof tamper protection.

In addition, or alternatively, the first circuit lines 301 of the firstflexible layer may be formed of a first material, and the second circuitlines 301′ of the second flexible layer may be formed of a secondmaterial, where the first material of the first circuit lines 301 may bedifferent from the second material of the second circuit lines 301′. Forinstance, first circuit lines 301 may be formed of conductive ink, andsecond circuit lines 301′ may be formed of a metal, such as copper. Byproviding tamper-respondent sensor 300′ with at least some of thecircuit lines formed of a metal material, such as copper, enhancedtamper detection may be obtained. For instance, an intrusion toolpassing through one or more layers of circuit lines 301′ formed of ametal could generate debris which may be distributed during theintrusion attempt and result in shorting or otherwise damaging one ormore other tamper-respondent layers within the tamper-respondent sensor300′. If desired, more than two materials may be employed in more thanone layers of circuit lines within the tamper-respondent sensor.

FIG. 3E depicts another embodiment of a tamper-respondent assembly 300″,in accordance with one or more aspects of the present invention. In thisimplementation, multiple tamper respondent layers 305 are secured withanother flexible layer 320 in a stack using, for instance, one or morelayers of an adhesive film 311. In one or more implementations, theanother flexible layer 320 could comprise a malleable metal film. In theexample shown, the malleable metal film is disposed between twotamper-respondent layers 305, and thus, is disposed between two layersof circuit lines 301 on the different tamper-respondent layers 305. Byway of example, malleable metal film 320 could comprise a sheet ofcopper or a copper alloy. By providing a thin malleable metal film 320on the order of, for instance, 0.001″ thickness, an attempt to penetratethrough tamper-respondent sensor 300″ would necessarily pass throughmalleable metal film 320, and in so doing generate debris which would becarried along by the intrusion tool or drill. This metal debris wouldfacilitate detection of the intrusion attempt by potentially shorting orotherwise damaging one or more of the tamper-respondent layers 305within tamper-respondent sensor 300″. As a variation, the malleablemetal film 320 could be applied directly to one side of a flexible layer302 with the opposite side having circuit lines forming the at least oneresistive network. Note that a similar concept applies where one or moreof the layers of circuit lines 301 are formed of metal circuit lines,such as copper or silver, and other layers of circuit lines 301 areformed of, for instance, conductive ink. In such embodiments, clippingof one or more metal lines would generate metal debris that couldcarried along by the intrusion tool and ultimately interact with one ormore other circuit lines of the tamper-respondent electronic circuitstructure to enhance the likelihood of damage and thus detection of theintrusion attempt.

Based on the description provided herein, those skilled in the art willunderstand that the tamper-respondent sensors described above inconnection with FIGS. 3A-3E may be employed with any of a variety ofdifferent tamper-respondent assemblies, and if desired, may bepre-formed in any of the various configurations described herein below.For instance, one or more of the tamper-respondent sensors of FIGS.3A-3E could be used in conjunction with an electronic enclosure toenclose, at least in part, one or more electronic components to beprotected, with the tamper-respondent sensor overlying or being adheredto an outer surface of the electronic enclosure. Alternatively, in oneor more implementations, the tamper-respondent sensor could be providedto cover or line an inner surface of the electronic enclosure, such asin one or more of the tamper-respondent assembles described below.

In contrast to a prior tamper-respondent sensor which may utilize asingle substrate of flexible dielectric with circuit lines, either onthe upper or lower surface, or both surfaces, provided herein aretamper-respondent sensors which comprise, in one or more embodiments,multiple layers of materials and circuits to provide an enhancedtamper-proof, tamper-evident packaging, to meet the demands ofever-improving anti-intrusion technology requirements to protectencryption/decryption functions. By way of example, FIGS. 4A & 4B depicttamper-respondent sensors comprising stacks of layers, each of whichinclude at least one formed flexible layer, which may be configured, byway of example, as a corrugated layer of flexible dielectric withcircuit lines on one or both sides. Note that as used herein, a “formedlayer” refers to a specially-shaped layer manufactured with, forinstance, curvatures extending, at least in part, out-of-plane. Forexample, in the case of a corrugated layer as shown, the curvatures havea vertical component that results in an undulation of the formed layer.

As illustrated in FIG. 4A, a tamper-respondent sensor 400 may include,by way of example, a first sensor layer 410, a second sensor layer 420,and a third sensor layer 430, with the second sensor layer 420 beingsandwiched between the first and third sensor layers 410, 430. In thisconfiguration, second sensor layer 420 comprises a formed flexible layer401 having opposite first and second sides with circuit lines 402comprising, for instance, conductive lines, such as metal lines (e.g.,Cu or Au lines), wires, printed conductive ink (e.g., carbon ink),resistive materials, etc., which form at least one resistive network onat least one of the first side or the second side of the formed flexiblelayer. In one or more embodiments, the circuit lines may comprisefine-pitched line circuitry, for instance, circuit lines in the 20-50micron width range, and 20-50 micron spaces between the circuit lines.In one or more implementations, the formed flexible layer comprises, atleast in part, a dielectric material (such as polyimide, Mylar™,Teflon™, etc.), with the layer in such an example being referred to as acorrugated layer of flexible dielectric that has the circuit linesoverlying, at least in part, the curvatures of the corrugated layer offlexible dielectric, as illustrated. Note in the example of FIG. 4A, across-section through the tamper-respondent sensor 400 intersectsmultiple layers of circuit lines on the different sensor layers. Thewiring patterns of the circuit lines may be in any desiredconfiguration. For instance, circuit lines may be orthogonal or angled,or randomly arranged, with respect to adjacent or underlying oroverlying circuit lines of the tamper-respondent sensor. This optionapplies to any of the tamper-respondent sensors disclosed herein, wherecircuit lines are provided on multiple different surfaces of atamper-respondent sensor. As a further variation, each tamper-respondentelectronic circuit structure may have a unique circuit lineconfiguration or set of circuit line configurations associated with, forinstance, a serial number of the tamper-respondent electronic circuitstructure being provided. Also, any desired number of sensor layers maybe associated with the at least one formed flexible layer of thetamper-respondent sensor.

Therefore, in one or more embodiments, first sensor layer 410 and thirdsensor layer 430 may also each comprise a flexible layer of materialhaving circuit lines forming one or more resistive networks disposed onthe first and/or second sides thereof. For instance, conductive circuitlines may be provided on both the first and second sides of the flexiblelayers of the first sensor layer 410, the second sensor layer 420, andthe third sensor layer 430, such that a vertical cross-section throughthe stack of layers intersects multiple layers of circuit lines. In thisconfiguration, forming the second sensor layer 420 with curvatures, forinstance, forming the second layer to be corrugated, advantageouslyenhances protection against physical intrusion, such as by a drill,without detection by the resistive networks by making the location ofthe circuit lines defining the resistive network(s) harder to identify.

By way of example, the second sensor layer 420 may initially comprise athin, flexible layer of material, such as a thin, flexible layer with athickness comparable to the desired minimum radius of the bendingcurvature for the desired corrugation of the second sensor layer. In oneor more implementations, the second sensor layer may be corrugated byobtaining a flat, flexible sensor which is then fed through a set ofheated top and bottom rollers, each with mating gear teeth to create thedesired sinusoidal pattern in the sensor layer. One or more outercircuit layers or films comprising the circuit lines forming the one ormore resistive networks may then be laminated, as desired, to one orboth of the first and second sides of the formed layer to define theformed, flexible layer. In one or more implementations, an adhesive maybe employed to affix the circuit layers or films comprising the one ormore resistive networks to the formed layer. By way of example, theadhesive could include a PSA, epoxy, acrylic, thermoset, thermoplastic,electrically conductive epoxy, thermally conductive epoxy, etc., one ormore of which could also be employed to affix the multiple sensor layers410, 420, 430 together within the stack of layers.

As illustrated in FIG. 4B, multiple second, corrugated layers 420 offlexible dielectric with circuit lines may be provided in the stack oflayers of the tamper-respondent sensor 400 with, for instance, adjacentcorrugated layers of flexible dielectric being separated by asubstantially flat flexible layer, with or without additional circuitlines defining one or more additional resistive networks. In theembodiment depicted, adjacent corrugated layers of flexible dielectricwith circuit lines are separated by a sensor layer 425, which again mayinclude circuit lines on one or both sides thereof.

Connections of the tamper-respondent sensors, and sensor layers,described herein to, for instance, monitor circuitry disposed within theassociated secure volume defined by the tamper-respondent electroniccircuit structure may comprise input/output contacts or connectorsformed on one or more edges of the tamper-respondent sensor (or sensorlayer) or, for instance, one or more ribbon cables extending from thetamper-respondent sensor into the secure volume, as will be understoodby one skilled in the art.

FIGS. 5A & 5B depict another embodiment of a tamper-respondent sensor500, in accordance with one or more aspects of the present invention. Asillustrated, tamper-respondent sensor 500 includes at least one formedflexible layer 510 having opposite first and second surfaces 511, 512.Circuit lines 501 forming at least one resistive network are provided onat least one of the first or second sides 511, 512 of formed flexiblelayer 510. As noted, the circuit lines may comprise any desired patternof conductive circuit lines advantageous for a particulartamper-respondent sensor technology, and may include multiple sets ofcircuit lines in different regions or zones of the formed flexiblelayer. By way of example, the circuit lines may comprise conductivelines such as metal lines (e.g., copper lines), wires, printedconductive ink (e.g., carbon ink), etc. provided on one or both of thefirst and second sides of formed flexible layer 510. As illustrated inFIG. 5A, the formed flexible layer again includes curvatures 513, withthe formed flexible layer with curvatures being collapsed as aflattened, folded layer in this embodiment. Note that circuit lines 501forming the at least one resistive network on the first side 511 orsecond side 512 of formed flexible layer 510 overlie, at least in part,at least some of curvatures 513, such that the circuit lines wrap overor within the curvatures 513 and in transverse cross-section view,provide multiple layers of circuit lines formed on the same curvingsurface of the formed flexible layer. In one or more embodiments, formedflexible layer 510 may be a corrugated layer that has been flattened byapplying a z-direction force with a metered x-y shear force, creating acontrolled, flattening collapse of the multi-dimensional, formedflexible layer 510.

FIGS. 5C-5H depict various examples of a tamper-respondent sensorcomprising a stack of layers, with one or more of the layers comprisinga formed flexible layer 510, such as described above in connection withFIGS. 5A & 5B. By way of example, FIG. 5C depicts a stack of layerscomprising formed flexible layer 510 with at least one other layer 520overlying one or both of first side 511 and second side 512 of formedflexible layer 510. In one or more embodiments, the at least one otherlayer 502 overlying the formed flexible layer 510 may be, or include, anopaque layer of material to mask location of the circuit lines, or abreakable layer of material that will shatter with tampering andfacilitate damaging the circuit lines forming the at least one resistivenetwork to assist with detection of the attack on the tamper-respondentsensor. In one or more implementations, the opaque layer of material maybe dark, non-transparent material obscuring what lies beneath, or, inone or more embodiments, the opaque material could be the same colormaterial as the resistive circuit lines of the underlying layer, bothobscuring and camouflaging the covered circuit lines.

In FIG. 5D, multiple other layers 521, 522 overlie one or both sides511, 512 of formed flexible layer 510. In one example, the multipleother layers may include both a breakable layer 521 and an opaque layer522 disposed on one side of formed flexible layer 510, or both sides offormed flexible layer 510.

In further embodiments, one or more of the other layers may themselvescomprise a flexible dielectric material with circuit lines forming atleast one other resistive network on one of the first side or secondside thereof. FIG. 5E depicts one other layer 520 overlying second side512 of formed flexible layer 510, and FIG. 5F depicts one other layer520 overlying first side 511, and one other layer 520 overlying secondside 512 of formed flexible layer 510.

FIGS. 5G & 5H depict additional embodiments of a tamper-respondentsensor 500 comprising a stack of layers. In these embodiments, multipleformed flexible layers 510 are provided along with one or more otherlayers overlying one or more sides 511, 512 of the formed flexiblelayers 510. As noted, the one or more other layers may comprise avariety of layers, such as an opaque flexible layer, a breakable layer,or additional flexible layers with circuit lines forming additionalresistive networks of the tamper-respondent sensor, as desired toprovide enhanced tamper-proof, tamper evident packaging for a particularapplication.

FIGS. 6A-6G depict various embodiments of a tamper-respondent assembly,generally denoted 600, within which a secure volume is defined forprotecting one or more electronic components or an electronic assembly,such as discussed herein. Referring to FIG. 6A, tamper-respondentassembly 600 may include an electronic enclosure 601, such as a rigid,conductive enclosure, and a tamper-respondent electronic circuitstructure 602 associated with the electronic enclosure 601. As shown,tamper-respondent electronic circuit structure 602 comprises atamper-respondent sensor 605. In one or more implementations,tamper-respondent sensor 605 includes at least one formed flexible layerhaving opposite first and second sides, circuit lines forming at leastone resistive network disposed on at least one of first or second sides,and formed curvatures provided within the formed flexible layer, withthe circuit lines overlying, at least in part, the curvatures of theformed flexible layer, such as described above in connection with theexemplary embodiments of FIGS. 4A-5H.

In the implementation of FIG. 6A, a single, continuous tamper-respondentsensor 605 is provided, which is wrapped around to encircle electronicenclosure 601, and which includes overlaps 606 where the ends join alongthe electronic enclosure 601. For instance, the single, continuoustamper-respondent sensor 605 could be folded around electronic enclosure601 in any manner analogous to wrapping a present. By way of exampleonly, electronic enclosure 601 may be a 6-sided metal container, sizedto accommodate the electronic to be protected. Further, in thisconfiguration, tamper-respondent sensor 605, configured as describedherein, may be employed in an electronic assembly package such asdescribed initially in connection with FIGS. 1 & 2.

FIGS. 6B-6G depict further embodiments of tamper-respondent assembly600. In one or more of these embodiments, multiple discretetamper-respondent sensors 610, 611, 612, are illustrated. By way ofexample, each tamper-respondent sensor may include one or more formedflexible layers with circuit lines extending, at least in part, over thecurvatures of the formed flexible layers, such as described herein.

In the example of FIG. 6B an upper tamper-respondent sensor 610 and alower tamper-respondent sensor 611 are provided overlying the upper andlower main surfaces, respectively, of electronic enclosure 601.Additionally, a sidewall tamper-respondent sensor 612 wraps around theedge of electronic enclosure 601, and in this example, is of sufficientwidth to fold over and thus overlap 606 upper tamper-respondent 610 andlower tamper-respondent 611, as illustrated. The extent of overlap 606may be customized as desired to inhibit a line of attack through thetamper-respondent electronic circuit structure at the seams wheredifferent tamper-respondent sensors 610, 611, 612 meet.

FIG. 6C is an upper plan view of one embodiment of the assembly of FIG.6B, with tamper-respondent sensor 612 shown wrapping over uppertamper-respondent sensor 610 provided over the upper main surface ofelectronic enclosure 601. An analogous wrapping of tamper-respondentsensor 612 over the lower tamper-respondent sensor may also be employed.Note in this configuration the provision of diagonal folds 615 at thecorners, where tamper-respondent sensor 612 overlaps uppertamper-respondent sensor 610. This overlap and fold example of FIG. 6Cis provided by way of example only, and other overlap and foldconfigurations may be employed, without departing from the scope of theclaims presented herewith. In this six-sided enclosure example, sidewalltamper-respondent sensor 612 is a separate sensor that wraps around theperimeter of electronic assembly enclosure 601, and overlaps the upperand lower tamper-respondent sensors 610, 611, respectively.

FIG. 6D depicts a variation on the tamper-respondent assembly 600 ofFIG. 6B, wherein upper tamper-respondent sensor 610 and lowertamper-respondent sensor 611 are extended past the upper and lowersurfaces, respectively, of electronic enclosure 601 and folded tooverlap sidewall tamper-respondent sensor 612 provided along the edge orperimeter of electronic enclosure 601.

FIGS. 6E & 6F depict alternate embodiments of upper tamper-respondentsensor 610, for use in various embodiments of a tamper-respondentassembly, including, for instance, an assembly such as depicted in FIG.6D, where upper tamper-respondent sensor 610 wraps over an edge of theenclosure and sidewall tamper-respondent sensor 612 is sized to thewidth of the edge or sidewall of electronic enclosure 601. In the uppertamper-respondent sensor 610 embodiment of FIG. 6E, corner cutouts orindents 607 are established to facilitate folding of the illustratededge flaps over the sidewall tamper-respondent sensor 612 asillustrated, for instance, in FIG. 6D. If desired, where the edge flapsmeet at the corners of the assembly package, additional cornertamper-respondent sensors (not shown) may be used as patches over thecorners to provide still further tamper-proof, tamper-evident packagingalong the respective seams of the edge flaps. Note that, in thisconfiguration, the sidewall tamper-respondent sensor 612 (FIG. 6D) wrapsfully around the electronic enclosure 601, and thus, necessarilyprovides coverage at the seams where the edge flaps meet.

As a variation, FIG. 6F depicts upper tamper-respondent sensor 610 withcorner cutouts 608 reduced to slots or channels to define tabs from theedge flaps at the corners of the edge flaps, so as to allow for afurther folding along the edge or sidewall of the electronic enclosure601. That is, the further tabs may be transversely folded over the seambetween adjoining edge flaps at the corners when the uppertamper-respondent sensor 610 is folded over sidewall tamper-respondentsensor 612, such as illustrated in FIG. 6D.

Note that in the embodiments of FIGS. 6A-6D, the tamper-respondentsensors may have respective input/output (I/O) cabling extending off oneor more ends thereof in a region under an overlap area of two of thetamper-respondent sensors, with the I/O cabling extending into thesecure volume of the package to make electrical connection with thetamper-detect circuitry. For instance, the resistive networks within thetamper-respondent sensors may be electrically coupled to circuitrywithin the secure volume for monitoring the networks. The monitorcircuitry may include various bridge and/or compare circuits, andutilize conventional electrical interconnect inside the secure volume ofelectronic enclosure 601. Any of a number of interconnect configurationsmay be employed dependent, for instance, on the number andcharacteristics of the resistive networks provided within thetamper-respondent sensors.

In the embodiment of FIG. 6G, tamper-respondent sensor 612 (FIG. 6D) isremoved, and size of the upper and lower tamper-respondent sensors 610,611 is extended to allow the upper and lower tamper-respondent sensors610, 611 to overlap along the edge or sidewall of electronic enclosure601 where folded, as shown.

Note that although depicted in FIGS. 6A-6G as flattened, folded layers,one or more of the respective tamper-respondent sensors illustratedcould be otherwise implemented. For instance, one or more of the upper,lower, or sidewall tamper-respondent sensors in the depicted examplescould comprise other formed, flexible layers, such as depicted in FIGS.4A-5H, or other non-formed, flexible layers, with circuit lines formingresistive networks on one or both opposing sides of the flexiblelayer(s). Further examples of tamper-respondent sensors are describedbelow in connection with FIGS. 7A-7C.

FIGS. 7A-7C depict a further embodiment of a tamper-respondent circuitstructure comprising one or more multi-sensor interweaved layers. Inparticular, a first tamper-respondent sensor 700 is depicted in FIG. 7Aas comprising at least one first layer 701, such as a flexibledielectric layer having opposite first and second sides. First circuitlines 702 are provided on at least one of the first side or the secondside of the at least one first layer 701 to form at least one firstresistive network. Multiple slits 703 are provided within the at leastone first layer 701, with the first circuit lines being located backfrom the multiple slits 703 a specified minimum distance, such as 2-10mils.

As illustrated in FIG. 7B, the tamper-respondent electronic circuitstructure may comprise a multi-sensor interweaved layer 720 defined byinterweaving first tamper-respondent sensor 700 with a secondtamper-respondent sensor 710 constructed, in one or more embodiments,similarly to first tamper-respondent sensor 700. In particular, secondtamper-respondent sensor 710 may include at least one layer, such as atleast one flexible layer having opposite first and second sides, andsecond circuit lines disposed on at least one of the first or secondsides of the at least one second layer, which define at least one secondresistive network. Note that the at least one first resistive networkand at least one second resistive network may be the same or differentlypatterned resistive networks. For instance, in one or moreimplementations, the width of the circuit lines or traces in thedifferent resistive networks, as well as the pitch between lines, may bevaried. By providing slits within first tamper-respondent sensor 700 andsecond tamper-respondent sensor 710, the resultant fingers of the firstand second tamper-respondent sensors may be interweaved to definemulti-sensor interweaved layer 720 to comprise a checkerboard pattern,as illustrated by way of example in FIG. 7B.

As depicted in FIG. 7C, an enhanced tamper-respondent electronic circuitstructure may be obtained by stacking two multi-sensor interweavedlayers 720, with the slit lines, and in particular, the intersections ofthe slit lines, offset to provide a more tamper-proof, tamper-evidentelectronic structure. For instance, the multi-sensor interweaved layer720 of FIG. 7B may be a first multi-sensor interweaved layer, and thecircuit structure may include a second multi-sensor interweaved layeroverlying the first sensor interweaved layer, with the secondmulti-sensor interweaved layer being formed from additional discretetamper-respondent sensors, in a manner such as described above inconnection with FIGS. 7A & 7B. In this configuration, the secondmulti-sensor interweaved layer 720′ may be constructed such that theslit intersections between the discrete tamper-respondent sensorsinterweaved into that layer do not align with those of the firstmulti-sensor interweaved layer 720 when stacked. For instance, the slitsin the second multi-sensor interweaved layer 720′ could be differentlyspaced apart from those in the first multi-sensor interweaved layer 720such that the intersections of the slits in the second multi-sensorinterweaved layer are offset from those in the first multi-sensorinterweaved layer, or second multi-sensor interweaved layer 720′ couldbe identically constructed as first multi-sensor interweaved layer 702,but offset slightly from the first multi-sensor interweaved layer whenstacked. Advantageously, in one or more implementations, one or moremulti-sensor interweaved layers 720, 720′ may be employed as one of theupper, lower, or sidewall tamper-respondent sensors described above inconnection with FIGS. 6A-6G, if desired.

By way of further example, FIGS. 8A & 8B depict one embodiment ofanother tamper-respondent assembly, or tamper-proof electronic package800, which comprises an electronic circuit 815, in accordance with oneor more further aspects of the present invention.

Referring collectively to FIGS. 8A & 8B, electronic circuit 815 includesa multilayer circuit board 810 which has an embedded tamper-respondentsensor 811 therein that facilitates defining, in part, a secure volume801 associated with multilayer circuit board 810 that extends intomultilayer circuit board 810. In particular, in the embodiment of FIGS.8A & 8B, secure volume 801 exists partially within multilayer circuitboard 810, and partially above multilayer circuit board 810. One or moreelectronic components 802 are mounted to multilayer circuit board 810within secure volume 801 and may comprise, for instance, one or moreencryption modules and/or decryption modules, and associated components,with the tamper-proof electronic package comprising, in one or moreembodiments, a communications card of a computer system.

Tamper-proof electronic package 800 further includes an enclosure 820,such as a pedestal-type enclosure, mounted to multilayer circuit board810 within, for instance, a continuous groove (or trench) 812 formedwithin an upper surface of multilayer circuit board 810. In one or moreembodiments, enclosure 820 may comprise a thermally conductive materialand operate as a heat sink for facilitating cooling of the one or moreelectronic components 802 within the secure volume. A security mesh ortamper-respondent sensor 821, such as the above-describedtamper-respondent sensors of FIGS. 4A-7C, may be associated withenclosure 820, for example, wrapping around the inner surface ofenclosure 820 to facilitate defining, in combination withtamper-respondent sensor 811 embedded within multilayer circuit board810, secure volume 801. In one or more implementations,tamper-respondent sensor 821 extends down into continuous groove 812 inmultilayer circuit board 810 and may, for instance, even wrap partiallyor fully around the lower edge of enclosure 820 within continuous groove812 to provide enhanced tamper detection where enclosure 820 couples tomultilayer circuit board 810. In one or more implementations, enclosure820 may be securely affixed to multilayer circuit board 810 using, forinstance, a bonding material such as an epoxy or other adhesive.

As depicted in FIG. 8B, one or more external circuit connection vias 813may be provided within multilayer circuit board 810 for electricallyconnecting to the one or more electronic components 802 (FIG. 8A) withinsecure volume 801. These one or more external circuit connection vias813 may electrically connect to one or more external signal lines orplanes (not shown) embedded within multilayer circuit board 810 andextending, for instance, into a secure base region of (or below) securevolume 801, as explained further below. Electrical connections to andfrom secure volume 801 may be provided by coupling to such externalsignal lines or planes within the multilayer circuit board 810.

As noted with reference to FIGS. 8A & 8B, secure volume 801 defined inassociation with multilayer circuit board 810 may be sized to houseelectronic components 802 to be protected, and be constructed to extendinto multilayer circuit board 810. In one or more implementations,multilayer circuit board 810 includes electrical interconnect within thesecure volume 801 defined in the board, for instance, for electricallyconnecting the multiple tamper-respondent layers of the embeddedtamper-respondent sensor 811 to associated monitor circuitry alsodisposed within secure volume 801.

Note that the embodiment depicted in FIGS. 8A & 8B is presented by wayof example only. In one or more other implementations, the electroniccircuit may comprise multiple multilayer circuit boards, each with atamper-respondent sensor embedded within the multilayer circuit boardwith an appropriate connector, located within a secure volume definedbetween two adjacent multilayer circuit boards, interconnecting selectedwiring of the multilayer circuit boards. In such an implementation, theoverlying multilayer circuit board could be hollowed out to accommodate,for instance, the connector and/or one or more other electroniccomponents between the multilayer circuit boards. In addition, otherconfigurations of enclosure 820, and/or other approaches to couplingenclosure 820 and multilayer circuit board 810 may be employed.

By way of further example, FIG. 9 depicts a partial cross-sectionalelevational view of one embodiment of multilayer circuit board 810 andenclosure 820. In this configuration, the embedded tamper-respondentsensor includes multiple tamper-respondent layers including, by way ofexample, at least one tamper-respondent mat (or base) layer 900, and atleast one tamper-respondent frame 901. In the example depicted, twotamper-respondent mat layers 900 and two tamper-respondent frame 901 areillustrated, by way of example only. The lower-most tamper-respondentmat layer 900 may be a continuous sense or detect layer extendingcompletely below the secure volume being defined within multilayercircuit board 810. One or both tamper-respondent mat layers 900 belowsecure volume 801 may be partitioned into multiple circuit zones, asdiscussed further below. Within each tamper-respondent mat layer, ormore particularly, within each circuit zone of each tamper-respondentmat layer, multiple circuits or conductive traces are provided in anydesired configuration, such as the configuration described above inconnection with FIG. 3. Further, the conductive traces within thetamper-respondent layers may be implemented as, for instance, aresistive layer which is difficult to attach shunt circuits to, asexplained further below.

As illustrated, one or more external signal lines or planes 905 entersecure volume 801 between, in this embodiment, two tamper-respondent matlayers 900, and then electrically connect upwards into the secure volume801 through one or more conductive vias, arranged in any desiredlocation and pattern. In the configuration depicted, the one or moretamper-respondent frames 901 are disposed at least inside of the areadefined by continuous groove 812 accommodating the base of enclosure820. Together with security sensor 821 associated with enclosure 820,tamper-respondent frames 901 define secure volume 801 where extending,in part, into multilayer circuit board 810. With secure volume 801defined, at least in part, within multilayer circuit board 810, theexternal signal line(s) 905 may be securely electrically connected to,for instance, the one or more electronic components 802 (FIG. 8A)mounted to multilayer circuit board 810 within secure volume 801. Inaddition, the secure volume 801 may accommodate electricalinterconnection of the conductive traces of the multipletamper-respondent layers, for instance, via appropriate monitorcircuitry.

Added security may be provided by extending tamper-respondent mat layers900 (and if desired, tamper-respondent frames 901) outward pastcontinuous groove 812 accommodating enclosure 820. In this manner, aline of attack may be made more difficult at the interface betweenenclosure 820 and multilayer circuit board 810 since the attack wouldneed to clear tamper-respondent mat layers 900, the bottom edge oftamper-respondent sensor 821 associated with enclosure 820, as well asthe tamper-respondent frames 901 of the embedded tamper-respondentsensor.

Variations on the multilayer circuit board 810 of FIG. 8A are possible.For instance, in this embodiment, the embedded tamper-respondent sensorinclude multiple tamper-respondent mat layers 900 and multipletamper-respondent frames 901, such as described above, and a tri-platestructure comprising one or more external signal lines or layerssandwiched between an upper ground plane and a lower ground plane. Inthis configuration, high-speed transfer of signals to and from thesecure volume, and in particular, to and from the one or more electroniccomponents resident within the secure volume, would be facilitated.

Note also that, once within the secure volume is defined withinmultilayer circuit board 810, conductive vias within the secure volumebetween layers of multilayer circuit board 810 may be either aligned, oroffset, as desired, dependent upon the implementation. Alignment ofconductive vias may facilitate, for instance, providing a shortestconnection path, while offsetting conductive vias between layers mayfurther enhance security of the tamper-proof electronic package bymaking an attack into the secure volume through or around one or moretamper-respondent layers of the multiple tamper-respondent layers moredifficult.

The tamper-respondent layers of the embedded tamper-respondent sensorformed within the multilayer circuit board of the electronic circuit orelectronic package may include multiple conductive traces or linesformed between, for instance, respective sets of input and outputcontacts or vias at the trace termination points. Any number ofconductive traces or circuits may be employed in defining atamper-respondent layer or a tamper-respondent circuit zone within atamper-respondent layer. For instance, 4, 6, 8, etc., conductive tracesmay be formed in parallel (or otherwise) within a giventamper-respondent layer or circuit zone between the respective sets ofinput and output contacts to those conductive traces.

In one or more implementations, the multilayer circuit board may be amultilayer wiring board or printed circuit board formed, for instance,by building up the multiple layers of the board. FIG. 10 illustrates oneembodiment for forming and patterning a tamper-respondent layer withinsuch a multilayer circuit board.

As illustrated in FIG. 10, in one or more implementations, atamper-respondent layer, such as a tamper-respondent mat layer or atamper-respondent frame disclosed herein, may be formed by providing amaterial stack comprising, at least in part, a structural layer 1001,such as a pre-preg (or pre-impregnated) material layer, a trace materiallayer 1002 for use in defining the desired trace patterns, and anoverlying conductive material layer 1003, to be patterned to defineconductive contacts or vias electrically connecting to the pattern oftraces being formed within the trace material layer 1002, for instance,at trace terminal points. In one or more implementations, the tracematerial layer 1002 may comprise nickel phosphorous (NiP), and theoverlying conductive layer 1003 may comprise copper. Note that thesematerials are identified by way of example only, and that other traceand/or conductive materials may be used within the build-up 1000.

A first photoresist 1004 is provided over build-up 1000, and patternedwith one or more openings 1005, through which the overlying conductivelayer 1003 may be etched. Depending on the materials employed, and theetch processes used, a second etch process may be desired to removeportions of trace material layer 1002 to define the conductive traces ofthe subject tamper-respondent layer. First photoresist 1004 may then beremoved, and a second photoresist 1004′ is provided over the conductivelayer 1003 features to remain, such as the input and output contacts.Exposed portions of conductive layer 1003 are then etched, and thesecond photoresist 1004′ may be removed, with any opening in the layerbeing filled, for instance, with an adhesive (or pre-preg) and a nextbuild-up layer is provided, as shown. Note that in this implementation,most of overlying conductive layer 1003 is etched away, with only theconductive contacts or vias remaining where desired, for instance, atthe terminal points of the traces formed within the layer by thepatterning of the trace material layer 1002. Note that any of a varietyof materials may be employed to form the conductive lines or traceswithin a tamper-respondent layer. Nickel-phosphorous (NiP) isparticularly advantageous as a material since it is resistant to contactby solder, or use of a conductive adhesive to bond to it, making itharder to bridge from one circuit or trace to the next during an attemptto penetrate into the protected secure volume of the electronic circuit.Other materials which could be employed include OhmegaPly®, offered byOhmega Technologies, Inc., of Culver City, Calif. (USA), or Ticer™,offered by Ticer Technologies of Chandler, Ariz. (USA).

The trace lines or circuits within all of the tamper-respondent layers,and in particular, the tamper-respondent circuit zones, of the embeddedtamper-respondent sensor, along with the tamper-respondent sensor 821,may be electrically connected into monitor or compare circuitryprovided, for instance, within secure volume 801 of multilayer circuitboard 810. The monitor circuitry may include various bridge or comparecircuits, and conventional printed wiring board electrical interconnectinside the secure volume 801, for instance, located within the securevolume defined by the tamper-respondent frames 901 (FIG. 9), and thetamper-respondent mat layers.

Note that advantageously, different tamper-respondent circuit zones ondifferent tamper-respondent layers may be electrically interconnectedinto, for instance, the same comparator circuit or Wheatstone bridge ofthe monitor circuitry. Thus, any of a large number of interconnectconfigurations may be possible. For instance, if each of twotamper-respondent mat layers contains 30 tamper-respondent circuitzones, and each of two tamper-respondent frames contains 4tamper-respondent circuit zones, then, for instance, the resultant 68tamper-respondent circuit zones may be connected in any configurationwithin the secure volume to create the desired arrangement of circuitnetworks within the secure volume being monitored for changes inresistance or tampering. Note in this regard, that the power supply orbattery for the tamper-respondent sensor may be located external to thesecure volume, with the sensor being configured to trip and destroy anyprotected or critical data if the power supply or battery is tamperedwith.

FIG. 11 is a partial enlarged view of the tamper-respondent assembly ofFIGS. 8A-9, with a tamper-respondent electronic circuit structure 1100comprising multiple tamper-respondent sensors 821, 822 disposed on theinner surface 825 of enclosure 820. As illustrated, in one embodiment,enclosure 820 and the inner sidewall-disposed, tamper-respondent sensor821 align at the bottom edge and extend into a continuous groove ortrench 812 in multilayer circuit board 810 comprising, or associatedwith, the electronic circuit to be protected, as explained above.Tamper-respondent sensors 821, 822 may overlap, for instance, a fewmillimeters, or more, in order to provide added tamper-proof protectionalong the seam, where the tamper-respondent sensors 821, 822 meet withinthe electronic assembly enclosure 820.

FIG. 12 depicts one example of a process for adhering atamper-respondent sensor 1200 to the inner surface 825 of enclosure 820.In this example, a single tamper-respondent sensor 1200 replaces thetamper-respondent sensors 821, 822 in the example of FIG. 11. However,the adhering apparatus and approach of FIG. 12 could also be applied tosecuring multiple tamper-respondent sensors 821, 822 to, for instance,the inner surface of electronic assembly enclosure 820. As illustrated,a bounding fixture 1210 may be used in combination with a first push andclamp mechanism 1211, and a second push and clamp mechanism 1212, tohold the tamper-respondent sensor 1200 in place while an adhesive 1205cures between the tamper-respondent sensor and inner surface 825 ofenclosure 820. Note that, in one or more embodiments, the radius of thetamper-respondent sensor 1200 in the corners of the enclosure can varyto account for tolerances of the flexible tamper-respondent sensorcomprising the one or more formed flexible layers.

FIGS. 13A-13C depict one example of a process for adheringtamper-respondent electronic circuit structure 1100 of FIG. 11 to innersurface 825 of electronic enclosure 820. As illustrated in theunderside, isometric view of FIG. 13A, inner surface 825 of electronicenclosure 820 includes an inner sidewall surface 1300 and an inner mainsurface 1301. Tamper-respondent sensor 821, also referred to herein asan inner-sidewall tamper-respondent sensor, may be secured to the innersidewall surface of enclosure 820 using an adhesive, such as a thermosetadhesive, in combination with an appropriate bonding fixture and pushand clamp mechanisms (not shown) to, for instance, aligntamper-respondent sensor 821 to the bottom edge of inner sidewallsurface 1300.

As depicted in FIG. 13B, in one or more implementations,tamper-respondent sensor 822 may concurrently or subsequently be affixedto main inner surface 1301 (FIG. 13A) of electronic enclosure 820 usinga bonding agent such as a thermoset adhesive. Note that in thisembodiment, tamper-respondent sensor 822 is sized to overlap, at leastin part, tamper-respondent sensor 821 affixed to inner sidewall surface1300 (FIG. 13A). This overlap is depicted in greater detail in thepartial enlargement of an inner corner 1302 of electronic enclosure 820in FIG. 13C. Advantageously, by providing two or more discretetamper-respondent sensors, securing of the tamper-respondent electroniccircuit structure to an electronic enclosure is facilitated by allowingmore flexibility to align a particular sensor to a particular portion ofthe electronic enclosure, such as to the bottom edge of the innersidewall surface of electronic enclosure 820, as in the example of FIGS.13A-13C.

As illustrated in FIG. 13C, inner corner 1302 of electronic enclosure820 may be shaped with one or more curved portions and one or more flat,angled-sidewall portions to facilitate wrapping of tamper-respondentsensor 821 over inner sidewall surface 1300 (as explained furtherbelow). Note further that, within electronic enclosure 820, varioustamper-respondent sensor overlap and folding arrangements may beemployed, as the case with the external wrapping of sensors about theelectronic enclosure depicted in FIGS. 6A-6G. In the embodiment of FIGS.13A-13C, the connections to the resistive networks of thetamper-respondent sensors 821, 822 may be provided in the region of theoverlap, between the sensors, which in the embodiment of FIGS. 8A-10,facilitate defining the secure volume between the electronic enclosureand the multilayer circuit board.

One consideration with a tamper-respondent assembly, and moreparticularly, a tamper-respondent electronic circuit structure such asdescribed herein, arises from the need to transition the inner-sidewalltamper-respondent sensor through one or more inner-sidewall corners ofan electronic enclosure such as described. As noted above, in one ormore embodiments, the tamper-respondent electronic circuit structurecomprises one or more tamper-respondent sensors, which are adhesivelymounted or affixed to the inner surfaces of the electronic enclosure.These inner surfaces include an inner main surface, and an innersidewall surface having, for instance, at least one inner-sidewallcorner. As noted, the tamper-respondent sensor(s) may each be formed ofone or more flexible layers having circuit lines on one or more layerswhich define tamper-detect networks, such as resistive networks, thatmay be connected to monitor circuitry for detection of intrusionattempts into the secure space defined by the tamper-respondentassembly. During fabrication, the flexible layers of thetamper-respondent sensor(s) could stretch and potentially buckle withinone or more inner-sidewall corners of the electronic enclosure as thesensor is mounted to the enclosure. This stretching or buckling withinthe corner(s) could result in breaking one or more circuit linesdefining the tamper-detect networks to be monitored, which would destroythe tamper-respondent assembly for its intended use. Further, anybuckling of the tamper-respondent sensor(s) over the inner surface, suchas at the inner-sidewall corner(s) of an inner sidewall surface, couldresult in potential breach points, which would cause thetamper-respondent assembly to fail a NIST FIPS 140-2 Level 4 securitytest. Described hereinbelow with reference to FIGS. 14A-18 therefore,are various enhancements to tamper-respondent assemblies such asdisclosed herein which address this concern.

FIGS. 14A & 14B depict in greater detail one embodiment of an electronicenclosure 1400, similar to enclosure 820 described above in connectionwith FIGS. 8A-13C. Referring collectively to FIGS. 14A & 14B, in thisexample, electronic enclosure 1400 includes an inner main surface 1401,which may be substantially flat, and an inner sidewall surface 1402,which in this example joins to inner main surface 1401 via a curved (orradiused) transition region 1403 around the inner perimeter ofelectronic enclosure 1400. Region 1403 provides a gradual transitionbetween inner sidewall surface 1402 and inner main surface 1401, whichin one or more embodiments, may be oriented orthogonal to each other. Inthe configuration depicted, electronic enclosure 1400 also includesmultiple inner-sidewall corners 1410, which may be configured tofacilitate transition between adjoining sides of electronic enclosure1400. By way of example, in the enlarged depiction of FIG. 14B, oneinner-sidewall corner 1410 is illustrated, which joins a first side 1404and a second side 1405 of electronic enclosure 1400. In one or moreimplementations, each inner-sidewall corner may be similarly configured.In the exemplary embodiment, which is presented by way of example only,inner-sidewall corner 1410 includes a flat, angled-sidewall portion1411, and first and second curved-sidewall portions 1412, 1413 locatedat opposite sides of flat, angled-sidewall portion 1411 as shown.

As one example, flat angled-sidewall portion 1411 may be oriented at a45° angle to the adjoining first side 1404 and second side 1405 ofelectronic enclosure 1400, which in one or more embodiments may beperpendicular to each other. In one or more implementations, first andsecond curved sidewall portions 1412, 1413 may have a similar bendradius, which may be, for instance, approximately five times or greaterthe thickness of the tamper-respondent sensor being mounted to the innersidewall surface of the electronic enclosure 1400. In the illustratedexample, transition region 1403 between inner sidewall surface 1402 andinner main surface 1401 continues within the inner-sidewall corners1410, where a lower part 1411′ of flat, angled-sidewall portion 1411curves outward in transition to inner main surface 1401, and lowerportions 1412′, 1413′ of first and second curved-sidewall portions 1412,1413 also further curve outward in transition to inner main surface1401, as illustrated. Note that the corner configuration of FIGS. 14A &14B is presented by way of example only, and that the present inventionmay be used with other corner designs without departing from theconcepts disclosed herein. Also, as noted, in one or moreimplementations, electronic enclosure 1400 may be employed incombination with a multilayer circuit board, such as multilayer circuitboard 810 described above in connection with FIGS. 8A-12, to define asecure volume about one or more electronic components or an electronicassembly, for instance, comprising an encryption and/or decryptionmodule and associated memory.

Electronic enclosure 1400 may be fabricated of a variety of materialsand have a variety of different configurations. In one or moreimplementations, the enclosure may be a rigid, thermally conductiveenclosure (fabricated, for instance, of a metal material) to facilitateconduction of heat from one or more electronic components within thesecure volume defined (at least in part) by the tamper-respondentassembly. Note also that the rectangular configuration of electronicenclosure 1400 could be replaced with any of a variety of differentenclosure configurations, any one of which may include one or moreinner-sidewall corners configured, by way of example, such asillustrated in FIGS. 14A & 14B.

FIGS. 15A & 15B depict underside, isometric views of a furtherembodiment of a tamper-respondent assembly employing electronicenclosure 1400. Referring collectively to FIGS. 15A & 15B, in one ormore implementations, tamper-respondent assembly 1500 includeselectronic enclosure 1400 which, as noted, is to enclose, at least inpart, one or more electronic components or an electronic assembly to beprotected. Electronic enclosure 1400 includes an inner main surface, andan inner sidewall surface including at least one inner-sidewall corner,such as described above in connection with FIGS. 14A & 14B. Further,tamper-respondent assembly 1500 includes a tamper-respondent electroniccircuit structure which includes at least one tamper-respondent sensormounted to and covering, at least in part, the inner surface(s) ofelectronic enclosure 1400. As explained further below, thetamper-respondent sensor(s) is configured so as to facilitate goodcontact, and good adhesion, of the sensor to the inner surfaces of theenclosure, such as, for instance, the one or more inner-sidewall cornersof the electronic enclosure 1400, to provide secure coverage of thetamper-respondent sensor(s) over the inner surface(s) of the electronicenclosure.

As illustrated, in one or more implementations, the tamper-respondentelectronic circuit structure associated with electronic enclosure 1400may include an inner-sidewall tamper-respondent sensor 1510 and an innermain surface tamper-respondent sensor 1520, along with a security band1530. In the illustrated example, inner-sidewall tamper-respondentsensor 1510 may be formed with an integrated flex ribbon cable orextension 1511 to facilitate electrical connection of the at least oneresistive network within inner-sidewall tamper-respondent sensor 1510 toappropriate monitor circuitry (not shown) disposed within, for instance,the secure volume defined, at least in part, by the tamper-respondentassembly of FIGS. 15A & 15B. Similarly, inner main surfacetamper-respondent sensor 1520 may be configured with an integrated flexribbon cable or extension 1521 to facilitate electrical connection ofinner main surface tamper-respondent sensor 1520 to the monitorcircuitry, as well. A bonding agent (not shown), such as a thermosetadhesive, may be employed to adhere inner-sidewall tamper-respondentsensor 1520 to inner sidewall surface 1402 (FIG. 14A) and toinner-sidewall corners 1410 (FIG. 14A). A similar adhesive could be usedto adhere inner main surface tamper-respondent sensor 1520 to inner mainsurface 1401 (FIG. 14A) and to inner-sidewall tamper-respondent sensor1510 where the sensors overlap. Security band 1530 may further beadhesively secured over the overlap between inner main surfacetamper-respondent sensor 1520 and inner-sidewall tamper-respondentsensor 1510 covering, in one or more implementations, transition region1403 (FIG. 14A) between the inner sidewall surface and the inner mainsurface around the inner perimeter of electronics enclosure 1400.

Note that, in the example provided in FIGS. 15A & 15B, inner-sidewalltamper-respondent sensor 1510 and inner main surface tamper-respondentsensor 1520 are discrete tamper-respondent sensors that overlap, atleast in part, and facilitate defining a secure volume about the atleast one electronic component to be protected. For instance, the securevolume may be defined by flipping over and securing the illustratedtamper-respondent assembly of FIGS. 15A & 15B to a multilayer circuitboard with an embedded tamper-respondent sensor, such as describedabove.

FIG. 16A depicts one embodiment of inner-sidewall tamper-respondentsensor 1510 of FIGS. 15A & 15B. In this embodiment, inner-sidewalltamper-respondent sensor 1510 includes at least one first layer 1600having opposite first and second sides 1601, 1602, and circuit lines1605 extending substantially over all of the flexible layer, and formingat least one tamper-detect network, such as described herein. Forinstance, circuit lines 1605 may be disposed on at least one of firstside 1601 or second side 1602 of the at least one flexible layer 1600.Note that the at least one flexible layer 1600 may be fabricated as aconventional security sensor layer, or be fabricated as one of theenhanced, tamper-respondent sensors described herein. In particular,although illustrated as a non-formed, flexible layer, the at least oneflexible layer 1600 of inner-sidewall tamper-respondent sensor 1510could comprise a formed flexible layer, such as one of the sensorsdepicted in FIGS. 4A-5H, or multiple weaved tamper-respondent sensors,such as illustrated in FIGS. 7A-7C. As noted, extension 1511 may extendfrom inner-sidewall tamper-respondent sensor 1510 to facilitateelectrical connection of the at least one resistive network of theinner-sidewall tamper-respondent sensor 1510 to appropriate monitorcircuitry (not shown) disposed within, for instance, the secure volumedefined, at least in part, by the tamper-respondent assembly of FIGS.15A & 15B. As illustrated, in one or more implementations,inner-sidewall tamper-respondent sensor 1510 is of sufficient length toencircle the inside of the electronic enclosure, covering the innersidewall surface thereof, and overlap at its ends. Further, multipleslots 1610 are provided within inner-sidewall tamper-respondent sensor1510. These multiple slots 1610 are sized and positioned along theinner-sidewall tamper-respondent sensor so as to approximately align (inone or more embodiments) to respective inner-sidewall corners of theelectronic enclosure to facilitate good contact, and good adhering, andbending the sensor within the inner-sidewall corners of the electronicenclosure, for instance, by allowing for regions of overlap of theinner-sidewall tamper-respondent sensor on itself.

FIGS. 16B & 16C depict one embodiment of inner-sidewalltamper-respondent sensor 1510 mounted within electronic enclosure 1400.As illustrated, in the exemplary embodiment, the inner-sidewalltamper-respondent sensor includes first and second slots thatrespectively overlie, at least in part, the first and secondcurved-sidewall portions 1412, 1413 (FIG. 14B) of the associatedinner-sidewall corner 1410 to be covered. These first and second slotsare spaced apart to reside at opposite sides of the flat,angled-sidewall portion 1411 (FIG. 14B) of the inner-sidewall corner1410, and facilitate reducing the amount of material in the corner andthereby enhance good contact and adhesion of the inner-sidewalltamper-respondent sensor 1510 to the inner sidewall surface 1402 (FIG.14A) of the electronic enclosure, including at the inner-sidewallcorners 1410 thereof, while also reducing stress on the sensor withinthe corner(s). For instance, the multiple slots 1610 allow foroverlapping of the inner-sidewall tamper-respondent sensor on itself atthe inner-sidewall corners, as illustrated. Note that, in thisconfiguration, the inner-sidewall tamper-respondent sensor 1510 has awidth which allows the sensor to cover the transition region 1403 (FIG.14A), as well as extend over, in part, the inner main surface 1401 ofelectronic enclosure 1400. Note also that one or more uncovered regions1615 may result from the presence of the slots when the inner-sidewalltamper-respondent sensor 1510 is wrapped around the inner sidewallsurface as shown, exposing portions of the inner sidewall surface at theinner-sidewall corner(s), for instance, along the seams where theinner-sidewall tamper-respondent sensor overlaps at the corner. Asexplained below, these regions 1615 may be covered or protected by innermain surface tamper-respondent sensor 1520 corner tabs once that sensorand its corner tabs are adhered to the assembly. This is illustrated, byway of example, in FIGS. 17A-17C.

Referring collectively to FIGS. 17A-17C, inner main surfacetamper-respondent sensor 1520 includes at least one flexible layer 1700having opposite first and second sides 1701, 1702, and circuit lines1705 extending substantially over all of the flexible layer 1700 andforming at least one tamper-detect network, such as described herein.For instance, circuit lines 1705 are disposed on one or both of firstside 1701 and second side 1702 of the at least one flexible layer 1700,as described. As noted above, the at least one flexible layer 1700 maybe fabricated as a conventional security sensor layer, or be fabricatedas one of the enhanced, tamper-respondent sensors described herein. Inparticular, although illustrated as a non-formed, flexible layer, the atleast one flexible layer 1700 of inner main surface tamper-respondentsensor 1520 could comprise a formed flexible layer, such as one or moreof the sensors depicted in FIGS. 4A-5H, or multiple weavedtamper-respondent sensors, such as illustrated in FIGS. 7A-7C. As noted,extension 1521 may be formed integral with inner main surfacetamper-respondent sensor 1520 to facilitate electrical connection of theat least one associated resistive network to monitor circuitry (notshown) within the secure volume being defined, at least in part, by thetamper-respondent assembly of FIGS. 15A & 15B; for instance, inassociation with a multilayer circuit board having an embeddedtamper-respondent sensor therein, as described above.

In the depicted configuration, multiple corner tabs 1710 are provided,with at least one corner tab 1710 being provided at the at least oneinner-sidewall corner. In the exemplary embodiment illustrated, twocorner tabs 1710 are provided at each corner of the inner main surfacetamper-respondent sensor 1520. These corner tabs 1710 include circuitlines 1705 (FIG. 17A) and are sized to cover a respective one of theuncovered regions 1615 in inner-sidewall tamper-respondent sensor andenclosure assembly which remain after securing inner-sidewalltamper-respondent sensor 1510 to electronic enclosure 1400, asillustrated in FIGS. 16B & 16C. In particular, those skilled in the artshould understand that corner tabs 1710 include respective portions ofthe at least one tamper-detect network provided by inner main surfacetamper-respondent sensor 1520, such that if an attempt were made tobreach the tamper-respondent assembly 1500 through the underlying,uncovered regions 1615 of the inner sidewall surface, the respectivecorner tab would be contacted, thereby resulting in detection of theattempted breach.

As noted above in connection with FIGS. 15A & 15B, reinforcement of theoverlap between inner-sidewall tamper-respondent sensor 1510 (FIG. 15A)and inner main surface tamper-respondent sensor 1520 (FIG. 15) may beprovided, in one or more implementations, by one or more physicalsecurity structures, such as security band 1530. One potential point ofexposure for a tamper-respondent assembly such as described herein wouldbe at an overlap between two or more tamper-respondent sensors, such asat an overlap between an inner-sidewall tamper-respondent sensor and aninner main surface tamper-respondent sensor. For instance, an attack ona tamper-respondent assembly could entail drilling through the enclosureand chemically attaching an overlapped bond area between twotamper-respondent sensors of the tamper-respondent electronic circuitstructure, such as the overlap area where inner main surfacetamper-respondent sensor 1520 is adhesively secured over inner-sidewalltamper-respondent sensor 1510. To address this concern, a physicalsecurity structure, such as security band 1530, may be provided. Notethat security band 1530 is one embodiment only of a physical securitystructure which could be employed to overlie and physically secure inplace, at least in part, one or more tamper-respondent sensors coveringone or more inner surfaces of an electronic enclosure, such as describedherein.

Generally stated, in one or more implementations, disclosed herein is atamper-respondent assembly which includes an electronic enclosure toenclose, at least in part, at least one electronic component to beprotected, wherein the electronic enclosure includes an inner surface.The tamper-respondent assembly also includes a tamper-respondentelectronic circuit structure comprising a tamper-respondent sensorlining and covering, at least in part, the inner surface of theelectronic enclosure. The tamper-respondent sensor may include aflexible layer having opposite first and second sides, and circuit linessubstantially covering at least one of the first side or the second sideof the flexible layer, forming at least one tamper-respondent network,such as described herein. The flexible layer of the tamper-respondentsensor could be a non-formed sensor layer or a formed sensor layer, inaccordance with one or more of the sensor layer embodiments describedherein.

The tamper-respondent assembly further includes a physical securitystructure, such as at least one security element, that overlies andphysically secures in place, at least in part, the tamper-respondentsensor covering, at least in part, the inner surface of the electronicenclosure. In the embodiment of FIGS. 15A & 15B, security band 1530 isillustrated which includes multiple security elements 1531, as shown inenlarged view in FIG. 18. Note that the security structure, such assecurity band 1530, could comprise a single element or multipleelements, depending on the desired configuration. In the example ofFIGS. 15A, 15B & 18, two substantially identical, U-shaped securityelements 1531 are illustrated, by way of example only. In the depictedembodiment, security elements 1531 are spaced apart, with gaps 1532therebetween. By providing two or more security elements 1531, to definea desired physical security structure (such as security band 1530)manufacturing tolerances may be better accommodated within thetamper-respondent assembly. By way of example, the gaps 1532 betweenadjacent security elements of the multiple, distinct security elements1531, may be on the order of several millimeters. Note that althoughillustrated as two security elements 1531, any number of physicalsecurity elements could be provided within the tamper-respondentassembly, and any number of security structures, such as multiplesecurity bands or plates, could be provided within the tamper-respondentassembly as desired to provide additional mechanical securing of thetamper-respondent sensor(s) in place over the inner surface of theelectronic enclosure.

In the example of FIGS. 15A, 15B & 18, the physical security structureis configured as a security band or collar comprising multiple distinctsecurity elements 1531 which extends substantially fully around theinner perimeter of the electronic enclosure 1400. The security band 1530is sized and positioned to overlie and physically secure in place atleast the overlap of the inner main surface tamper-respondent sensor andthe inner-sidewall tamper-respondent sensor, as illustrated in FIG. 15A.In one or more implementations, security band 1530 may be adhesivelysecured to the tamper-respondent sensors. Note that in this example,security band 1530, comprising security elements 1531, extends aroundthe inner perimeter, including through the inner-sidewall corners, asillustrated in FIG. 15A. In this manner, security elements 1531advantageously overlie and secure in place the overlap(s) of theinner-sidewall tamper-respondent sensor and the inner main surfacetamper-respondent sensor at the inner-sidewall corners of the electronicenclosure. By way of example, in the embodiment depicted, security band1530, or more particularly, security elements 1531, overlie andphysically secure in place the multiple corner tabs 1710 (FIG. 17C)projecting from the inner main surface tamper-respondent sensor 1520 atthe inner-sidewall corners of the electronic enclosure. Thisadvantageously prevents an attack against the tamper-respondent assemblythrough the areas lined by the multiple corner tabs projecting from theinner main surface of the tamper-respondent sensor. The security band1530 creates a mechanical barrier that prevents the tamper-respondentsensors from being separated.

In one or more enhanced embodiments, the security element(s) definingthe security band, or more generally, the physical security structure,are formed (for instance, by stamping) a metal material, or metal alloy,such as copper, soft stainless steel, etc. Further, the metal securityelement(s) may advantageously be electrically connected to ground tofurther enhance detection capabilities of the tamper-respondentassembly. By forming the security element(s) of a metal that isdifficult to drill through, then, if an attempt were made to drillthrough the security element, metal fragments would be created, whichpotentially could be pulled into the sensor layer(s) lining the innersurface of the electronic enclosure, which would result in a greaterchance of shorting or otherwise damaging the circuit lines forming theone or more tamper-respondent networks of the sensor during the attack,and thus enhance detection capability of the tamper-respondent sensor.Further, by electrically grounding the security element(s), then a drillcontacting the grounded security element(s) after drilling through oneor more tamper-respondent sensors would be more likely to short one ormore of the circuit lines forming the at least one tamper-detect networkin the associated tamper-respondent sensor(s). By grounding the securityelement(s), another path for current to flow is established, whichadvantageously increases the likelihood of detecting an attempt totamper with the tamper-respondent assembly. Note that grounding of thesecurity element(s) could be by any means, such as by electricallyconnecting the elements to one or more ground lines on the electronicassembly being protected by the tamper-respondent assembly, or (incertain of the embodiments disclosed herein) by electrically connectingthe elements to one or more ground planes within the multilayer circuitboard forming, in part, the secure volume about the electronic assemblybeing protected. In one or more implementations, the securityelement(s), or more generally, the security band or physical securitystructure, may be pre-formed (e.g., by stamping) into the desired shape,for example, to accommodate and overlie the overlap between theinner-sidewall tamper-respondent sensor and the inner main surfacetamper-respondent sensor, such as depicted in FIG. 15A.

As a further enhancement, increased sensor sensitivity to a tamper eventmay be provided by fabricating the tamper-respondent assembly, and inparticular, the tamper-respondent sensor, to include one or more regionswith increased fragility or susceptibility to damage from mechanicalstress resulting from or associated with a tamper event. By includingcircuit lines or traces of the tamper-respondent sensor at least in partwithin the one or more regions of increased susceptibility to damage,then there is an increased likelihood that one or more of the circuitlines may be damaged during the tamper event due the associatedmechanical stress, thus enhancing ability to detect the tamper event.The one or more regions of the tamper-respondent sensor having increasedsusceptibility may be formed using a variety of approaches, such asselective laser ablation or etching of the sensor, configuring thesensor with cutout areas to define stress-concentrating inner edges,and/or directly adhering exposed circuit lines to a rigid surface of thetamper-respondent assembly. By way of example, FIGS. 19A-20B depictexamples of tamper-respondent assemblies with one or moretamper-respondent sensors having one or more regions of increasedsusceptibility to damage due to mechanical stress associated with atamper event.

Referring to FIG. 19A, a tamper-respondent assembly 1900 is depictedcomprising a structure 1901 having a rigid surface 1902. By way ofexample only, structure 1901 could comprise an electronic enclosure orhousing surrounding, at least in part, one or more electronic componentsto be protected. By way of specific example, rigid surface 1902 could bean outer surface of an electronic enclosure, or an inner surface of anelectronic enclosure. FIGS. 6A-6G depict exemplary embodiments of one ormore tamper-respondent sensors of a tamper-respondent electronic circuitstructure being adhered to an outer surface of an electronic enclosure,while FIGS. 8A-17C depict exemplary embodiments of one or moretamper-respondent sensors being adhered to an inner surface of anelectronic enclosure. Still further, structure 1901 might be or compriseany rigid structure of an electronic assembly, or cooling apparatusassociated with an electronic assembly to be protected. In one or morespecific instances, structure 1901 could comprise a heat sink, such as athermal spreader.

As illustrated, tamper-respondent assembly 1900 includes atamper-respondent electronic circuit structure comprising atamper-respondent sensor 1910. In the depicted embodiment,tamper-respondent sensor 1910 includes one or more flexible layers 1911having opposite first and second sides 1912, 1913, and circuit lines1915, 1915′ forming, at least in part, at least one tamper-detectnetwork. For instance, the circuit lines may form, at least in part, atleast one resistive network electrically coupled to monitor circuitrysuch as described herein. By way of example, first circuit lines 1915are disposed on first side 1912, and second circuit lines 1915′ aredisposed on second side 1913 of flexible layer 1911. The circuit linesmay be in the same or different patterns, as described above. Further,note that there may be any number of flexible layers 1911, and anynumber of circuit line 1915, 1915′ layers provided withintamper-respondent sensor 1910 as discussed above, for instance, inconnection with FIGS. 3A-3E, with the illustrated embodiment beingprovided by way of example only.

In accordance with one or more aspects of the present invention, circuitlines 1915 at first side 1912 of flexible layer 1911 are exposed, thatis, any overlying protective layer, such as a polyimide layer, is atleast partially, or fully, removed in the region to be secured to rigidsurface 1902 of structure 1901. Note that circuit lines 1915, 1915′ maybe formed of a variety of materials including, for instance, a metal ormetal alloy. For instance, first circuit lines 1915 could be formed fromcopper, silver, silver-carbon, nickel-phosphorous. Alternatively, othermaterials, such as conductive ink or Omega-Ply®, or Ticer™, could beemployed.

In the exemplary embodiment, an adhesive 1920, such as a thermosetmaterial, is used to adhere or laminate tamper-respondent sensor 1910 torigid surface 1902. In particular, in the embodiment depicted, theexposed first circuit lines 1915 on first side 1912 are directly,adhesively secured to rigid surface 1902 of structure 1901. In one ormore implementations, adhesive 1920 is selected with a bond strength tosecure first circuit lines 1915 to rigid surface 1902 that is equal orgreater to a bond strength of first circuit lines 1915 to first side1912 of one or more flexible layers 1911. In this manner, should atamper event occur comprising an attempt to physically separatetamper-respondent sensor 1910 from structure 1901, one or more of firstcircuit lines 1915 will likely separate from flexible layer 1911, andthus be broken, with the resultant broken lines enhancing the ability ofthe tamper-respondent electronic circuit structure to detect the tamperevent.

In one or more embodiments, setoff elements could be provided betweenrigid surface 1902 of structure 1901 and first side 1912 oftamper-respondent sensor 1910 to ensure the presence of a gap betweenfirst side 1912 of tamper-respondent sensor 1910 and the rigid surface1920, and thus ensure that adhesive 1920 remains between the twosurfaces during a fabrication approach where pressure may be applied toforce the surfaces together to, for instance, facilitate the laminatingof tamper-respondent sensor 1910 to structure 1901. In one or moreimplementations, the setoff elements could be dispersed throughoutadhesive 1920 and may comprise, for instance, spherical elements 1922,such as glass spheres, disposed within the adhesive. Alternatively, inone or more implementations, rigid surface 1902 could be formed with oneor more standoffs extending from the surface a desired gap distance.

FIG. 19B depicts an alternate embodiment of a tamper-respondent assembly1900′, in accordance with one or more aspects of the present invention.In this embodiment, structure 1901 of FIG. 19A is replaced by anelectronic enclosure 1400, such as described above in connection withFIGS. 14A & 14B, as a further example. Electronic enclosure 1400includes a rigid surface 1902′, which may be, for instance, the innermain surface 1401 (FIG. 14A) or inner-sidewall surface 1402 (FIG. 14A)in the exemplary embodiment of FIGS. 14A & 14B.

As illustrated in FIG. 19B, in one or more implementations,tamper-respondent assembly 1900′ may also include a tamper-respondentsensor 1910′, and another structure 1930, with another rigid surface1932. By way of example, in one or more implementations, anotherstructure 1930 may comprise a cooling structure, such as a thermalspreader, provided to facilitate cooling of one or more componentswithin the electronic enclosure.

In one or more embodiments, tamper-respondent sensor 1910′ may comprisea stack of tamper-respondent layers secured together via an adhesivelayer 1925, such as a double-sided adhesive film, similar to thestructure described above in connection with FIG. 3C. However, in thisexample, the circuit line widths and line-to-line spacings may be of anydesired dimension, with the above-described line widths and spacings of≦200 μm, respectively, being one example. Tamper-respondent sensor 1910′includes multiple layers of circuit lines 1915, 1915′ which may beelectrically connected to define one or more tamper-detect networks,such as one or more resistive networks. Any of the various materialsdescribed herein, or other known materials, may be employed to form thecircuit lines. The circuit lines are provided on one or both sides ofrespective flexible layers 1911, with first circuit lines 1915 beingprovided on a first side of each flexible layer 1911, and second circuitlines 1915′ being provided on a second side of the layer, as one exampleonly. The flexible layers 1911 may be formed of any flexible, dielectricmaterial, such as a polyester material. Alternatively, the flexiblelayers 1911 could be formed of a crystalline polymer, such as theabove-described PVDF, or Kapton, or other crystalline-polymer material.

In accordance with one or more aspects of the present invention, aportion of circuit lines 1915 is exposed on the upper side and a portionof circuit lines 1915′ is exposed on the lower side of tamper-respondentsensor 1910′. The exposed circuit lines 1915, 1915′ are respectivelylaminated using an adhesive layer 1920, 1920′, to rigid surface 1902′ ofelectronic enclosure 1400, or to rigid surface 1932 of another structure1930, as illustrated. That portion of tamper-respondent sensor 1910′adhered to electronic enclosure 1400 and/or to another structure 1930defines the one or more regions of the tamper-respondent sensor havingthe increased susceptibility to damage from mechanical stress associatedwith a tamper event. That is, should a tamper event attempt todelaminate the tamper-respondent sensor from one or both of electronicenclosure 1400 and another structure 1930, then adhesive layers 1920,1920′ bonding the structures to the first side and the second side oftamper-respondent sensor 1910′, will likely cause one or more of theexposed circuit lines 1915, 1915′ to delaminate from thetamper-respondent sensor as the structures are separated, causing breaksin the circuit lines, and thereby facilitating detection of the tamperevent by monitor circuitry of the tamper-respondent electronic circuitstructure. As noted, this result can be facilitated by selecting theadhesive 1920, 1920′ to have, for instance, an equal or greater bondstrength than the bond strength holding circuit lines 1915, 1915′ totheir respective sides of the tamper-respondent sensor 1910′.

As noted, in the embodiments depicted in FIGS. 19A & 19B, the circuitlines may comprise a metal, such as copper, laminated directly to arigid surface of the tamper-respondent assembly to define regions of thetamper-respondent sensor that have increased susceptibility to damagefrom mechanical stress associated with a tamper event, such as a tamperevent which physically disturbs the lamination of the tamper-respondentsensor to the rigid surface. In one or more other implementations, theregion(s) of the tamper-respondent sensor with increased susceptibilitymay be provided by increasing fragility of the tamper-respondent sensor.This may be accomplished, for example, through the provision of cutoutareas in the sensor, such as channels, notches, openings, etc., whichdefine one or more stress-concentrating inner edges (or stress risers)within the tamper-respondent sensor. Various examples of this approachare depicted in FIGS. 20A & 20B.

Referring to FIG. 20A, one embodiment of a tamper-respondent assembly2000 is illustrated. As shown, tamper-respondent assembly 200 includes atamper-respondent sensor 2001, with multiple peripheral edges 2002 oftamper-respondent sensor 2001 being shown. As described herein, such aswith reference to FIGS. 3A-3E, tamper-respondent sensor 2001 includesone or more flexible layers 2011, and one or more layers of circuitlines 2015 on one or both opposite sides of each flexible layer 2011.The circuit lines 2015 may be electrically connected to define one ormore tamper-detect networks, such as one or more resistive networks. Thetamper-respondent layers within the stack may be adhesively laminatedtogether using, for instance, a double-sided adhesive film 2025, asdiscussed above.

Multiple regions 2032, 2042 within tamper-respondent sensor 2001 ofincreased susceptibility to damage from mechanical stress are defined inthis example by providing the tamper-respondent sensor with one or morecutout areas 2030, 2040. In the exemplary embodiment, cutout areas 2030are illustrated as rectangular-shaped cutouts, extending into the sensorfrom one or more peripheral edges 2002, and cutout areas 2040 aretriangular-shaped cutouts, extending into the sensor from one or moreperipheral edge 2002 of the tamper-respondent sensor 2001. In eachinstance, cutout areas 2030, 2040 define stress-concentrating inneredges 2031, 2041, which (in this example) extend vertically throughtamper-respondent sensor 2001. These edges 2031, 2041 are stress riserswhich define the regions 2032, 2042, respectively, of increasedsusceptibility to damage within tamper-respondent sensor 2001. Theregions 2032, 2042 are locations within the sensor 2001 where stress isconcentrated due to the provision of the stress-concentrating inneredges 2031, 2041. For instance, circuit lines 2015 may be provided whichfollow the contours of tamper-respondent sensor 2001 and extend, atleast in part, through the respective regions 2032, 2042 of increasedsusceptibility to damage. In this manner, should a tamper event occur,mechanical stress within the tamper-respondent sensor will beconcentrated by the stress-concentrating inner edges 2031, 2041, inregions 2032, 2042 of the sensor, thereby increasing a likelihood of abreak in one or more of the circuit lines 2015 within those regions.This increased likelihood of a break facilitates detection of the tamperevent by the monitor circuitry of the tamper-respondent electroniccircuit structure.

Note that the circuit lines 2015 may be provided in any desiredconfiguration or pattern on the various flexible layers 2011, asdescribed herein. For instance, a rectangular grid of circuit linescould be provided in one or more layers which intersects, at least inpart, the regions 2032, 2042 of increased susceptibility to damage frommechanical stress associated with a tamper event. Note also that regions2032, 2042 of the tamper-respondent sensor are distinct regions of thesensor, separate from the balance of the tamper-respondent sensor, whichmay be characterized as being a standard robustness region outside ofthe regions 2032, 2042 created with the increased susceptibility todamage from mechanical stress. Thus, the tamper-respondent sensor may bethought of as being divided into different regions, a standardrobustness region, and the regions 2032, 2042 of increasedsusceptibility to damage resulting from the provision of stress riserswithin the tamper-respondent sensor.

Note that any stress in one or more of regions 2032, 2042 of increasedsusceptibility to damage may extend vertically across multiple layers ofthe tamper-respondent sensor 2001, or be associated with one or moreparticular tamper-respondent layers (or flexible layers) within thetamper-respondent sensor 2001, dependent, for instance, on the tamperevent. In one or more implementations, the cutouts, comprising forinstance cutout areas 2030 and/or cutout areas 2040, may extend around aportion or all of the periphery of tamper-respondent sensor 2001, in anydesired configuration and number. Further, any cutout configuration maybe used that provides stress-concentration regions within thetamper-respondent sensor, for instance, due to the presence of one ormore stress-concentrating inner edges (or stress risers). Additionalembodiments of this concept are depicted in FIG. 20B.

Referring to FIG. 20B, a tamper-respondent assembly 2000′ is illustratedas comprising a tamper-respondent sensor 2001′ of a tamper-respondentelectronic circuit structure. The tamper-respondent sensor 2001′ ispartially depicted, with a corner thereof shown defined by peripheraledges 2002. In this implementation, a cutout area 2030 is againdepicted, defining (for instance) multiple stress-concentrating inneredges 2031 which define an adjoining region or regions 2032 of thetamper-respondent sensor having increased susceptibility to damage frommechanical stress within the sensor. By way of further example, in linewith cutout area 2030, one or more openings 2050 are formed extendingthrough tamper-respondent sensor 2001′. The one or more openings 2050include one or more stress-concentrating inner edges 2051 extendingvertically through tamper-respondent sensor 2001′, which respectivelydefine one or more regions 2052 within the tamper-respondent sensorhaving increased susceptibility to damage from mechanical stress withinthe sensor accompanying a tamper event. The stress-concentrating inneredges 2051 associated with opening 2050 again increase likelihood ofdamage to those portions of circuit lines 2015 of the tamper-respondentsensor 2001′ extending through the one or more of the regions of highersusceptibility to damage. For instance, tamper-respondent sensor 2001′may be more likely to delaminate in regions 2052 of increasedsusceptibility to damage in response to a tamper event. Note that anymechanical stress within the tamper-respondent sensor may propagatethrough the sensor and be concentrated by the stress-concentrating inneredges 2051 within regions 2052, resulting in increased susceptibility todamage for any circuit lines extending through those regions.

In the exemplary embodiment of FIG. 20B, tamper-respondent sensor 2001′is illustrated as comprising one or more flexible layers 2011 havingopposing first and second sides, with circuit lines 2015 disposed on theopposing first and second sides. Protective layers 2026 are disposedover the first and second sides of the one or more flexible layers 2011and circuit lines 2015. By way of example, protective layers 2026 maycomprise a polyimide material, as one example only.

As illustrated, cutout areas 2060 may also, or alternatively, byprovided as one or more channels extending through protective layers2026 above and/or below the one or more flexible layers 2011 and circuitlines 2015. These cutout areas 2060 again comprise stress-concentratinginner edges 2061, which define regions 2062 adjoining the edges withinthe tamper-respondent sensor 2001′ that have increased susceptibility todamage from mechanical stress accompanying a tamper event againsttamper-respondent sensor 2001′. As in the embodiments described above,circuit lines 2015 may extend, at least in part, through regions 2062 ofincreased susceptibility to damage, and thus, should a tamper eventoccur which generates mechanical stress within tamper-respondent sensor2001′, any circuit lines within the regions of increased susceptibilityto damage, for instance, in regions adjoining the stress-concentratinginner edges 2061, will more likely be damaged or break (that is,compared with the balance of the tamper-respondent sensor, characterizedabove as the standard robustness region of the sensor), therebyenhancing likelihood of detection of the tamper event by the monitorcircuitry of the tamper-respondent electronic circuit structurecomprising the tamper-respondent sensor 2001′.

Those skilled in the art will note that, disclosed herein are variousenhancements to creating a secure volume for accommodating one or moreelectronic components, such as one or more encryption and/or decryptionmodules and associated components of a communications card or otherelectronic assembly. In certain embodiments, the tamper-respondentassembly, or tamper-proof electronic package, includes atamper-respondent electronic circuit structure comprising one or moretamper-respondent sensors in various configurations disposed, forinstance, external to or internal to an electronic enclosure to containthe electronic component(s) or electronic assembly to be protected. Thetamper-respondent electronic circuit structure may also includetamper-detect monitor circuitry which monitors, for instance, forchanges in resistance in one or more tamper-detect networks, such as oneor more resistive networks, defined (at least in part) by circuit lineswithin the tamper-respondent sensor(s).

In one or more embodiments, the tamper-respondent sensor may beimplemented as a fine-pitch flex circuit being formed, for instance, ofmultiple stacked layers of flexible film, such as the above-describedcrystalline-polymer material, with Kapton being one specific example. Onone or more sides of each flexible layer, circuit lines are provided andelectrically connected to facilitate defining one or more tamper-detectnetworks of the tamper-respondent sensor. In one or moreimplementations, line width and pitch may be significantly reduced insize from conventional approaches to, for instance, ≦200 μm. The circuitlines may be formed of any appropriate material, including a metal ormetal alloy such as copper, silver, nickel-phosphorous (NiP),Omega-Ply®, or Ticer™. The flexible layers with the circuit lines areenclosed, for instance, by polyimide, such that the circuit lines areunexposed within the tamper-respondent sensor, and the tamper-respondentsensor provides a secure defense against a mechanical or physicalintrusion through the sensor into a secure volume defined, at least inpart, by the tamper-respondent sensor.

A variety of tamper-respondent assembly configurations are disclosedherein which may employ an adhesive in one or more external bond regionson a surface of the tamper-respondent sensor(s) to secure, for instance,a tamper-respondent sensor in an operative position within thetamper-respondent assembly. By way of example, the adhesive may beemployed to maintain a particular configuration of the tamper-respondentsensor about an electronic enclosure, or to bond two or moretamper-respondent sensors together in a multi-sensor configuration, orto position a tamper-respondent sensor relative to an electronicenclosure of a tamper-respondent assembly, such as over an inner surfaceof an electronic enclosure. These external bond regions could besusceptible to chemical attack against the adhesive.

Therefore, by way of further enhancement, increased sensitivity to atamper event may be provided by fabricating the tamper-respondentassembly to include conductive traces positioned and fabricated to haveincreased mechanical and/or chemical fragility or susceptibility todamage from a tamper event, and in particular to a tamper event at anexternal bond or overlap region of the sensor. For instance, one or moreconductive traces may be exposed within a bond region(s) of one or moretamper-respondent sensors, and an adhesive provided contacting theconductive trace(s) within the bond region(s) of the tamper-respondentsensor(s). By directly contacting the adhesive to the conductive traces,any attempt to mechanically and/or chemically tamper with the adhesive,to facilitate gaining access to the secure volume within thetamper-respondent assembly, is more likely to damage one or moreconductive traces, and thus be detected. Note in this regard, that byforming the conductive traces of a chemically compromisable ordissolvable conductive material during a chemical attack on theadhesive, then the conductive traces will likely be damaged during theattack on the adhesive. In this manner, the exposed conductive tracesprovide increased fragility or susceptibility to mechanical and/orchemical attack at the external bond region(s).

As noted, the at least one external bond region may be a region of thetamper-respondent sensor(s) where the sensor adheres to another surface,such as the surface of a rigid structure of the tamper-respondentassembly, or the surface of another tamper-respondent sensor, in amulti-tamper-respondent sensor embodiment, or even to another region ofthe same tamper-respondent assembly, such as depicted (for instance) inFIG. 6A. In each of these examples, one or more conductive traces couldbe provided to form, for instance, an outer tamper-detect network thatis exposed, at least in part, on a surface of the one or moretamper-respondent sensors within the bond region(s) of the sensor(s).

In one or more embodiments, these one or more conductive traces may bedistinct conductors from the unexposed circuit lines on the flexiblelayers within the tamper-respondent sensor(s). For instance, and asnoted, conductive traces may be formed of a chemically compromisable ordissolvable material susceptible to damage during a chemical attack ofthe adhesive within the bond region(s) of the tamper-respondentsensor(s) to facilitate detecting the chemical attack, whereas theunexposed circuit lines forming the tamper-respondent sensor may be of adifferent conductive material (and may even be of different line width,and/or line-to-line spacing) to facilitate, for instance, securing theone or more electronic components to be protected against a mechanicaltamper event through the sensor. In one or more examples, the circuitlines within the tamper-respondent sensor(s) may be smaller and ofcloser pitch than the conductive traces exposed on the surface of thetamper-respondent sensor(s) within the bond region(s). The one or moreconductive traces forming the outer tamper-detect network may be placedon the tamper-respondent sensor(s) in any location susceptible to achemical attack, such as where adhesive is employed to bond thetamper-respondent sensor to another surface of the tamper-respondentassembly, such as to an electronic enclosure, or to anothertamper-respondent sensor of the assembly, or even to itself, dependingon the implementation.

FIGS. 21A-21C depict one embodiment of a tamper-respondent assemblyhaving one or more tamper-respondent sensors with conductive tracespositioned and fabricated to facilitate detection of a mechanical and/orchemical attack against an adhesive of the tamper-respondent assembly.

Referring to FIG. 21A, a tamper-respondent assembly 2100 is depictedcomprising a structure 2101 having a rigid surface 2102. By way ofexample, structure 2101 is illustrated as an electronic enclosure orhousing surrounding, at least in part, one or more electronic components802 to be protected. By way of specific example, rigid surface 2102 isshown (by example) as an inner surface of the electronic enclosure, suchas an inner surface of electronic enclosure 1400 described above inconnection with FIGS. 14A-15B. The embodiment of FIG. 21A is presented,by way of example only, in connection with the implementation of FIGS.8A-17C, where one or more tamper-respondent sensors are adhered to aninner surface of an electronic enclosure. In this example, conductivetraces 2120 may be provided between discrete first and secondtamper-respondent sensors (such as inner-sidewall tamper-respondentsensor 1510′ and inner main surface tamper-respondent sensor 1520′), oralternatively, or additionally, conductive traces 2120′ may be providedbetween one or more of the tamper-respondent sensors and the innersurface of the enclosure.

Note also that, in one or more other implementations, the conductivetraces described herein as susceptible to damage during chemical attackof the adhesive, could be disposed between one or more tamper-respondentsensors and an outer surface of a structure, such as an outer surface ofan electronic enclosure. In this regard, reference the embodiments ofFIGS. 6A-6G, where one or more tamper-respondent sensors of atamper-respondent electronic circuit structure may be adhered to anouter surface of an electronic enclosure. Still further, the conductivetraces forming the outer tamper-detect network might be between thetamper-respondent sensor and any rigid structure of an electronicassembly, or cooling apparatus of an electronic assembly to beprotected. For instance, the conductive traces disclosed herein could bedisposed between one or more tamper-respondent sensors and a heat sink,such as a thermal spreader.

As illustrated, in one or more implementations, the tamper-respondentelectronic circuit structure of the tamper-respondent assembly 2100 mayinclude an inner-sidewall tamper-respondent sensor 1510′ and an innermain surface tamper-respondent sensor 1520′, each comprising one or moretamper-detect networks, such as one or more unexposed tamper-detectnetworks formed by circuit lines on one or more flexible layers, such asdescribed above. The one or more tamper-detect networks are electricallyconnected to appropriate monitor circuitry (not shown) disposed within,for instance, the secure volume 801 defined by tamper-respondentassembly 2100. Note that in this example, inner-sidewalltamper-respondent sensor 1510′ and inner main surface tamper-respondentsensor 1520′ are discrete, first and second tamper-respondent sensorsthat overlap, at least in part, and facilitate defining the securevolume about the at least one electronic component 802 to be protected.For instance, the secure volume may be defined by securing theelectronic enclosure to a multilayer circuit board 810 with an embeddedtamper-respondent sensor 811, such as described above in connection withFIGS. 8A-10. Note further, in the depicted configuration, inner-sidewalltamper-respondent sensor 1510′ may be bonded via an adhesive 2110 to aninner-sidewall surface of the electronic enclosure, wrapping partiallyaround and over, onto the inner main surface of the electronicenclosure, as shown. This allows the overlap region 2105 of theinner-sidewall tamper-respondent sensor 1510′ and inner main surfacetamper-respondent sensor 1520′ to occur at the flat, inner main surfaceportion of the structure 2101. An adhesive 2115 is provided to bondinner main surface tamper-respondent sensor 1520′ to the inner mainsurface of structure 2101, as well as to the inner-sidewalltamper-respondent sensor 1510′ in overlap region(s) 1205. Adhesives2110, 2115 may be the same or different adhesives. In one or moreimplementations, adhesives 2110, 2115 may be a thermoset material, suchas a thermally conductive epoxy.

As noted, to provide enhanced tamper-detect protection, one or moreconductive traces 2120 may be provided exposed, at least in part, on oneor more of the tamper-respondent sensors 1510′, 1520′ oftamper-respondent assembly 2100. For instance, one or more conductivetraces 2120 are illustrated in the overlap region 2105 betweeninner-sidewall tamper-respondent sensor 1510′ and inner main surfacetamper-respondent sensor 1520′, by way of example. Additionally, oralternatively, one or more conductive traces 2120′ could be provided, aspart of the same or a different tamper-detect network(s), on a surfaceof inner-sidewall tamper-respondent sensor 1510′ between inner-sidewalltamper-respondent sensor 1510′ and an inner-sidewall of structure 2101,and/or on a surface of inner main surface tamper-respondent sensor1520′, between inner main surface tamper-respondent sensor 1520′ andrigid surface 2102 of structure 2101. In one or more implementations,the conductive traces 2120, 2120′ in the bond region(s) are formed of achemically compromisable or dissolvable conductive material susceptibleto wetting or other damage during a chemical attack of the adhesive2110, 2115 in direct contact therewith. The damage may result indissolving one or more portions of the conductive traces, and thus, oneor more portions of the associated tamper-detect network(s) defined (atleast in part) by the traces and being monitored by thetamper-respondent electronic circuit structure, thereby facilitatingdetecting the tamper event. Note that the chemically dissolvableconductor used to form the conductive traces may be the same or adifferent material than the material used to form the unexposed circuitlines defining the one or more tamper-detect networks of the respectivetamper-respondent sensor.

Stated generally, the conductive traces may be formed of a chemicallycompromisable conductive material, and may be provided in any bondregion external to one or more sensors where, for instance, an adhesivebonds the respective tamper-respondent sensor to another surface, suchas another surface of the tamper-respondent assembly. By way of example,the chemically dissolvable material used to form the conductive tracesmay comprise, at least in part, at least one of carbon, silver, orcarbon-silver. For instance, the one or more conductive traces of therespective tamper-detect network(s) may be formed of a carbon-loadedconductive material, silver-loaded conductive material, orcarbon-silver-loaded conductive material. Note also that differentconductive traces may be in the same or different tamper-detectnetworks, and that conductive traces may be in the same or a differenttamper-detect network than the network(s) defined by the sensor'sunexposed circuit lines.

FIG. 21B depicts a modified version of inner main surfacetamper-respondent sensor 1520′ described above in connection with FIG.17A. As described above, inner main surface tamper-respondent sensor1520′ includes one or more flexible layers having opposite first andsecond sides, and circuit lines on the flexible layer(s) forming, atleast in part, at least one tamper-detect network, such as at least oneresistive network, where the circuit lines may be disposed on at leastone of the first side or the second side the flexible layer(s). Forinstance, multiple flexible layers could be provided within a stack,with circuit lines being defined on each side of each flexible layerwithin the stack, in any desired pattern and in any desired networkconfiguration, to facilitate detection of a mechanical attempt to gainaccess to the secure volume through the tamper-respondent sensor.

In the example of FIG. 21B, multiple conductive traces 2120 are providedabout the periphery of inner main surface tamper-respondent sensor 1520′in an area which aligns with a bond region of the tamper-respondentsensor, and in particular, aligns to an overlap region of, for instance,inner-sidewall tamper-respondent sensor 1510′, such as depicted in FIG.21A. Note in this regard, that two conductive traces 2120 are shown byway of example only. One, or more than two conductive traces in anydesired pattern could be provided within the bond region(s). Note alsothat, in the example of FIG. 21A, the bond region comprisessubstantially the entire upper surface of the inner main surfacetamper-respondent sensor 1520′, since the inner main surfacetamper-respondent sensor 1520′ is either bonded to the inner main rigidsurface 2102 (FIG. 21A) or to inner-sidewall tamper-respondent sensor1510′ (FIG. 21A). The conductive traces 2120 are illustrated in FIG. 21Bin the overlap region 2105 (FIG. 21A) between the two tamper-respondentsensors of the tamper-respondent assembly shown in FIG. 21A. Note thatin this implementation, a tamper-detect network is formed, at least inpart, by conductive traces 2120, and that this network may furtherinclude unexposed circuit lines 2121, such as unexposed circuit lineswithin the tamper-respondent sensor 1520′ itself. That is, atamper-detect network may include both exposed conductive traces 2120and unexposed circuit lines 2121, as desired for a particularapplication. The unexposed circuit lines may be provided within thetamper-respondent sensor to, for instance, complete the tamper-detectnetwork where not needed to be external for tamper-detect purposes. Forexample, in the implementation of FIG. 21B, the unexposed circuit lines2121 are shown extending within integrated flex ribbon cable orextension 1521′ of inner main surface tamper-respondent sensor 1520′.The integrated flex ribbon cable or extension 1521′ would be within thesecure volume 801 in the implementation of FIG. 21A to, for instance,facilitate electrical connection of the inner main surfacetamper-respondent sensor 1520′ to monitor circuitry within the securevolume. Note further, in one or more other implementations, where thebond region of the tamper-respondent sensor comprises only a portion ofthe outer surface of the tamper-respondent sensor, that both unexposedcircuit lines and exposed conductive traces may be employed in formingone or more tamper-detect networks, with the exposed conductive tracesonly residing in the bond region to provide the enhancedtamper-detection capability disclosed herein in areas susceptible tomechanical and/or chemical attack of the adhesive.

FIG. 21C illustrates a potential line of attack 2130 addressed by theenhanced tamper-respondent assembly of FIGS. 21A & 21B. In particular,line of attack 2130 may be attempted through structure 2101, intoadhesive 2115, with the attack involving a chemical attack against theadhesive in order to, for instance, separate inner main surfacetamper-respondent sensor 1520′ from inner main surface tamper-respondentsensor 1510′, and/or from the inner main surface of structure 2101. Byproviding one or more of conductive traces 2120, 2120′ as illustrated,any chemical attack against adhesive 2115 will also wet or otherwisedamage conductive traces 2120, 2120′, with the damage to the conductivetraces facilitating detection of the chemical attack by the monitorcircuitry, and thus, initiation of an alarm and/or triggering of anerasure of, for instance, encryption/decryption keys stored within thesecure volume.

The terminology used herein is for the purpose of describing particularembodiments only and is not intended to be limiting of the invention. Asused herein, the singular forms “a”, “an” and “the” are intended toinclude the plural forms as well, unless the context clearly indicatesotherwise. It will be further understood that the terms “comprise” (andany form of comprise, such as “comprises” and “comprising”), “have” (andany form of have, such as “has” and “having”), “include” (and any formof include, such as “includes” and “including”), and “contain” (and anyform contain, such as “contains” and “containing”) are open-endedlinking verbs. As a result, a method or device that “comprises”, “has”,“includes” or “contains” one or more steps or elements possesses thoseone or more steps or elements, but is not limited to possessing onlythose one or more steps or elements. Likewise, a step of a method or anelement of a device that “comprises”, “has”, “includes” or “contains”one or more features possesses those one or more features, but is notlimited to possessing only those one or more features. Furthermore, adevice or structure that is configured in a certain way is configured inat least that way, but may also be configured in ways that are notlisted.

The corresponding structures, materials, acts, and equivalents of allmeans or step plus function elements in the claims below, if any, areintended to include any structure, material, or act for performing thefunction in combination with other claimed elements as specificallyclaimed. The description of the present invention has been presented forpurposes of illustration and description, but is not intended to beexhaustive or limited to the invention in the form disclosed. Manymodifications and variations will be apparent to those of ordinary skillin the art without departing from the scope and spirit of the invention.The embodiment was chosen and described in order to best explain theprinciples of one or more aspects of the invention and the practicalapplication, and to enable others of ordinary skill in the art tounderstand one or more aspects of the invention for various embodimentswith various modifications as are suited to the particular usecontemplated.

What is claimed is:
 1. A method of fabricating a tamper-respondentassembly, the method comprising: providing at least onetamper-respondent sensor, the at least one tamper-respondent sensorcomprising one or more tamper-detect networks, and the at least onetamper-respondent sensor including at least one external bond region,wherein providing the at least one tamper-respondent sensor comprisesproviding unexposed circuit lines, the unexposed circuit lines beingformed of a first conductive material; providing at least one conductivetrace forming, at least in part, at least one tamper-detect network ofthe one or more tamper-detect networks, the at least one conductivetrace being exposed, at least in part, on the at least onetamper-respondent sensor within the at least one external bond region,wherein the at least one conductive trace is formed of a secondconductive material, where the first conductive material and secondconductive material comprise, at least in part, different materials; andproviding an adhesive contacting the at least one conductive tracewithin the at least one external bond region of the at least onetamper-respondent sensor, the adhesive facilitating securing the atleast one tamper-respondent sensor within the tamper-respondentassembly.
 2. The method of claim 1, wherein the adhesive bonds to the atleast one conductive trace with an equal or greater bond strength than abond strength of the at least one conductive trace to the at least onetamper-respondent sensor where exposed within the at least one externalbond region.
 3. The method of claim 1, wherein providing the at leastone conductive trace comprises providing a chemically dissolvableconductor susceptible to damage during a chemical attack on the adhesivewithin the at least one external bond region of the tamper-respondentsensor, the damage facilitating detection of the chemical attack by thetamper-respondent assembly.
 4. The method of claim 3, wherein thechemically dissolvable conductor comprises, at least in part, at leastone of carbon or silver.
 5. The method of claim 1, wherein the at leastone conductive trace is partially unexposed, being disposed, at least inpart, within the at least one tamper-respondent sensor.
 6. The method ofclaim 1, wherein the at least one external bond region of the at leastone tamper-respondent sensor comprises at least one overlap region ofthe at least one tamper-respondent sensor.
 7. The method of claim 1,wherein fabricating the tamper-respondent assembly further comprisesproviding a rigid surface wherein the adhesive, at least in part, bondsthe at least one external bond region of the at least onetamper-respondent sensor, with the exposed at least one conductivetrace, to the rigid surface.
 8. The method of claim 7, whereinfabricating the tamper-respondent assembly further comprises providingan electronic enclosure to surround, at least in part, at least oneelectronic component to be protected, the rigid surface being a surfaceof the electronic enclosure.
 9. A method of fabricating atamper-respondent assembly, the method comprising: providing a firsttamper-respondent sensor comprising at least one first tamper-detectnetwork; providing a second tamper-respondent sensor comprising at leastone second tamper-detect network, the first tamper-respondent sensor andthe second tamper-respondent sensor being discrete, tamper-respondentsensors that overlap, at least in part, and facilitate defining a securevolume about at least one electronic component to be protected;providing at least one conductive trace, the at least one conductivetrace being exposed, at least in part, on the first tamper-respondentsensor within the overlap, and forming, at least in part, atamper-detect network of the at least one first tamper-detect network ofthe first tamper-respondent sensor; and providing an adhesive securingthe first tamper-respondent sensor and the second tamper-respondentsensor together within the overlap, the adhesive being in contact withthe at least one conductive trace.
 10. A method of fabricating atamper-respondent assembly, the method comprising: providing at leastone tamper-respondent sensor, the at least one tamper-respondent sensorcomprising one or more tamper-detect networks, and the at least onetamper-respondent sensor including at least one external bond region;providing at least one conductive trace forming, at least in part, atleast one tamper-detect network of the one or more tamper-detectnetworks, the at least one conductive trace being exposed, at least inpart, on the at least one tamper-respondent sensor within the at leastone external bond region; providing an adhesive contacting the at leastone conductive trace within the at least one external bond region of theat least one tamper-respondent sensor, the adhesive facilitatingsecuring the at least one tamper-respondent sensor within thetamper-respondent assembly; providing an electronic enclosure, theelectronic enclosure to enclose, at least in part, at least oneelectronic component to be protected, and the at least onetamper-respondent sensor being adhesively secured to at least onesurface of the electronic enclosure, wherein the at least one surface ofthe electronic enclosure comprises at least one inner surface of theelectronic enclosure; providing a multilayer circuit board, the at leastone electronic component being associated with the multilayer circuitboard; providing an embedded tamper-respondent sensor within themultilayer circuit board; and sealing the electronic enclosure to themultilayer circuit board, wherein the at least one tamper-respondentsensor and the embedded tamper-respondent sensor within the multilayercircuit board facilitate defining a secure volume about the at least oneelectronic component.